What is CVE-2021-47746?

CVE-2021-47746 is a high-severity vulnerability in Nodebb Plugin Emoji, classified under External Control of File Name or Path. CVSS score: 7.5/10. Published 2026-01-21.

How severe is CVE-2021-47746?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Nodebb Plugin Emoji

CVE-2021-47746

NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through the emoji upload API. Attackers with admin access can craft file upload requests with directory traversal to overwrite system files by manipulating the file path parameter.

EPSS: 0.007 (48.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Nodebb Plugin Emoji — versions 3.2.1

Weakness classification (CWE)

CWE-73 — External Control of File Name or Path

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2021-47746?: CVE-2021-47746 is a high-severity vulnerability in Nodebb Plugin Emoji, classified under External Control of File Name or Path. CVSS score: 7.5/10. Published 2026-01-21.
How severe is CVE-2021-47746?: High severity. CVSS v3 base score is 7.5 out of 10.