# CVE-2021-26293: AfterLogic Aurora and WebMail Pro - Path Traversal

> Live exploitation tracking for CVE-2021-26293 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-26293

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** AfterLogic Aurora, AfterLogic WebMail Pro
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

## Description

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.

## CrowdSec analysis

[CVE-2021-26293](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-26293), a path traversal vulnerability in AfterLogic Aurora and WebMail Pro through version 8.5.3, when DAV is enabled, allows attackers to create arbitrary files—including executable files—under the web root directory. Exploiting this flaw could enable remote code execution or the deployment of malicious scripts, posing a significant risk to the affected systems.

CrowdSec has been tracking this vulnerability and its exploits since 30th of June 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2021-26293 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending POST requests to DAV endpoints, attempting to create files via directory traversal, potentially leading to webshell upload or arbitrary file creation.

## Timeline

- 2021-03-04: CVE Published. CVE-2021-26293 is published to NVD.
- 2025-06-30: Rule Released. CrowdSec releases a rule to detect CVE-2021-26293 exploitation attempts against the CrowdSec Network.
- 2025-09-24: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-26293 for the first time.

## References

- https://auroramail.wordpress.com/2021/02/03/addressing-dav-related-vulnerability-in-webmail-and-aurora/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-26293) follows observed exploitation activity for CVE-2021-26293. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.