Skip to content
OpenAdvisories
Critical · 9.8 Known exploited CVE-2021-27860 EUVD-2021-14598GHSA-hfgw-xgjr-v384

Arbitrary file upload vulnerability in FatPipe software

Published Dec 8, 2021 · Updated Oct 21, 2025 · Assigned by certcc

Description

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.

Affected products

VendorProductAffectedFixed
FatPipe WARP 10.1 – < 10.1.2r60p92, 10.2 – < 10.2.2r44p1 10.1.2r60p92
FatPipe IPVPN 10.1 – < 10.1.2r60p92, 10.2 – < 10.2.2r44p1 10.1.2r60p92
FatPipe MPVPN 10.1 – < 10.1.2r60p92, 10.2 – < 10.2.2r44p1 10.1.2r60p92

References