CVE-2021-46115: Jpress

High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days.

jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code.

Affected products

• Jpress Jpress: version 4.2.0 only

Published 2022-01-26. Last modified 2026-07-09.