AfterLogic Aurora and WebMail Pro - Path Traversal (CVE-2021-26293)
Description
An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.
psychologyCrowdSec Analysis
CVE-2021-26293, a path traversal vulnerability in AfterLogic Aurora and WebMail Pro through version 8.5.3, when DAV is enabled, allows attackers to create arbitrary files—including executable files—under the web root directory. Exploiting this flaw could enable remote code execution or the deployment of malicious scripts, posing a significant risk to the affected systems.
CrowdSec has been tracking this vulnerability and its exploits since 30th of June 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2021-26293 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by sending POST requests to DAV endpoints, attempting to create files via directory traversal, potentially leading to webshell upload or arbitrary file creation.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2021-03-04 |
| Rule Released | 2025-06-30 |
| CrowdSec First Seen | 2025-09-24 |