CVE-2021-43829: PatrOwl PatrowlManager unrestricted file upload in findings import

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with a public exploit reference and very high EPSS percentile, though no KEV listing and exploitation requires authentication.

What it is

PatrowlManager before 1.7.7 does not restrict file types in the findings import feature, allowing upload of dangerous files. This enables cross-site scripting and potentially other code injection on the server. The flaw is remotely reachable and rated high severity (CVSS 8.8).

Impact

An authenticated attacker can upload malicious files that execute script in other users' browsers or inject code on the server, compromising confidentiality, integrity and availability.

Attack surface

Reached over the network through the findings import upload feature; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is high (0.59, 99th percentile) and a public exploit reference exists on huntr.dev, indicating meaningful exploitation likelihood.

What to do

• Upgrade PatrowlManager to version 1.7.7 or later, which contains the patch commit.
• Restrict the findings import feature to trusted users and enforce strict file type and content validation.
• Store uploaded files outside the web root and serve them with a non-executable content type.
• Apply a web application firewall rule to block executable or script file uploads to the import endpoint.

Detection

• Monitor upload requests to the findings import endpoint for executable, script or HTML file extensions.
• Alert on files written to web-accessible directories with script or executable content.
• Review server logs for anomalous POST requests to import functionality from low-privilege accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.