CVE-2021-36233: UNIT4 Mik.starlight

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the filesystem by specifying the file path.

Affected products

• UNIT4 Mik.starlight: version 7.9.5.24363 only

Published 2021-08-31. Last modified 2026-06-17.