CVE-2021-27230: Expressionengine

High severity, CVSS 8.8. EPSS: 2.8% chance of exploitation in the next 30 days.

ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under the system/user/language directory.

Affected products

• Expressionengine Expressionengine: before 5.4.2 (fixed in 5.4.2); from 6.0.0, before 6.0.3 (fixed in 6.0.3)

Published 2021-03-15. Last modified 2026-06-17.