CVE-2021-27367: Boltcms Bolt

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal.

Affected products

• Boltcms Bolt: before 4.1.13 (fixed in 4.1.13)

Published 2021-02-17. Last modified 2026-06-17.