CVE-2021-26294: Afterlogic Aurora

High severity, CVSS 7.5. EPSS: 16.9% chance of exploitation in the next 30 days.

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).

Affected products

• Afterlogic Aurora: up to and including 7.7.9
• Afterlogic Webmail Pro: up to and including 7.7.9

Published 2021-03-07. Last modified 2026-06-17.