CVE-2021-4463

Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.

CVSS v4.0

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

1.45% chance of exploitation in the next 30 days, 72th percentile

Nuclei

high

Published

2025-11-12

Updated

2026-05-14

Proof-of-concept exploits (4)

• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php
• https://www.exploit-db.com/exploits/50163
• https://packetstormsecurity.com/files/163702
• https://cxsecurity.com/issue/WLB-2021070173

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4463.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-44629
• CVE-2021-44630
• CVE-2021-44628
• CVE-2021-44631
• CVE-2021-44627
• CVE-2021-44632