CVE-2021-38621: Netless Flat Server

Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days.

The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership.

Affected products

• Netless Flat Server: before 2021-07-30 (fixed in 2021-07-30)

Published 2021-08-13. Last modified 2026-06-17.