CVE-2021-27101

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Accellion FTA versions 9_12_370 and earlier contain a SQL injection vulnerability triggered by a crafted Host header sent to the document_root.html endpoint. The affected component is the Accellion File Transfer Appliance (FTA), a managed file transfer product. The issue received a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction.

An unauthenticated remote attacker can supply a malicious Host header to inject arbitrary SQL statements, resulting in full read, write, and delete access to the underlying database and potentially the host system. Successful exploitation grants complete control over confidentiality, integrity, and availability of data processed by the appliance.

Vendor guidance states that the flaw is resolved in FTA version 9_12_380 and later. The vulnerability appears in CISA's catalog of known exploited vulnerabilities, confirming observed in-the-wild use against unpatched deployments.