CVE-2021-23803: Nette Latte

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.

Affected products

• Nette Latte: before 2.10.6 (fixed in 2.10.6)

Published 2021-12-17. Last modified 2026-06-17.