CVE-2021-41566: Tadtools Project Tadtools

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.

Affected products

• Tadtools Project Tadtools: before 3.2.2 (fixed in 3.2.2)

Published 2021-10-08. Last modified 2026-06-17.