CVE-2021-21064: Magento Upward Connector

Medium severity, CVSS 4.9. EPSS: 8.5% chance of exploitation in the next 30 days.

Magento UPWARD-php version 1.1.4 (and earlier) is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 (and earlier) due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which allows reading arbitrary files from the remote server. Access to the admin console is required for successful exploitation.

Affected products

• Magento Upward Connector: up to and including 1.1.2
• Magento Upward PHP: up to and including 1.1.4

Published 2021-02-25. Last modified 2026-06-17.