LiveActive security incident?Get immediate response
CVE Record

CVE-2021-42651: A Server Side Template Injection (SSTI) vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an a...

A Server Side Template Injection (SSTI) vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary code through /project/PROJECTNAME/reports/.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Pentest-Collaboration-Framework v1.0.8 reportedly lets an authenticated remote user turn report handling into arbitrary code execution. For leaders, the concern is takeover of a security collaboration platform that may contain sensitive assessment data. Public scoring and affected-product metadata are incomplete.

Executive priority

Treat as high priority if PCF is deployed, because authenticated code execution can compromise sensitive security-project data. Prioritize inventory first, then confirm patch status from upstream guidance.

Technical view

CVE-2021-42651 is described as server-side template injection in Pentest-Collaboration-Framework v1.0.8, reachable through /project/PROJECTNAME/reports/ by an authenticated remote attacker. The CVE bundle provides no CVSS, CWE, CPE, or detailed affected-product record beyond the description and one upstream commit reference.

Likely exposure

Exposure is most likely in organizations running Pentest-Collaboration-Framework v1.0.8, especially shared or internet-reachable instances where multiple users can authenticate. The source bundle does not identify broader affected versions or downstream packages.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. The vulnerability requires authenticated remote access according to the CVE description, but successful abuse is reported to allow arbitrary code execution.

Researcher notes

Evidence is limited. The record names PCF v1.0.8 and a reports path, but lacks CVSS, CWE, CPE, vendor/product fields, and detailed mitigation text. The linked commit is the main remediation lead.

Mitigation direction

  • Identify any Pentest-Collaboration-Framework v1.0.8 deployments.
  • Review the linked upstream commit and project guidance for remediation.
  • Restrict PCF access to trusted users until remediation is confirmed.
  • Reduce internet exposure where business operations allow.
  • Monitor report-related activity for suspicious behavior.

Validation and detection

  • Confirm deployed PCF version and whether the referenced fix is present.
  • Inventory users who can access project report pages.
  • Review logs for unusual report creation, editing, or rendering activity.
  • Check whether report functionality accepts user-controlled templates.
  • Document findings because public affected-version metadata is incomplete.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-42651 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.