CVE-2021-41790: Alfresco Content Services

High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days.

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script Action execution allows executing scripts uploaded outside of the Data Dictionary. This could allow a logged-in attacker to execute arbitrary code inside a sandboxed environment.

Affected products

• Alfresco Alfresco Content Services: from 5.0.0.0, up to and including 5.2.7.11; from 6.0.0.0, up to and including 6.0.1.9; from 6.1.0.0, up to and including 6.1.1.10; from 6.2.0.0, up to and including 6.2.2.18; from 7.0.1.0, up to and including 7.0.1.2; version 7.0 only; …

Published 2021-10-21. Last modified 2026-06-17.