CVE-2021-29377: Pearadmin Think

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded via admin.php/index/upload because app/common/service/UploadService.php mishandles fileExt.

Affected products

• Pearadmin Pearadmin Think: up to and including 2.1.2

Published 2021-08-12. Last modified 2026-06-17.