CVE-2021-31800: Fedoraproject Fedora

Critical severity, CVSS 9.8. EPSS: 19.4% chance of exploitation in the next 30 days.

Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.

Affected products

• Fedoraproject Fedora: version 32 only; version 33 only; version 34 only
• Secureauth Impacket: up to and including 0.9.22

Published 2021-05-05. Last modified 2026-06-17.