CVE-2021-47822
Published: 16 January 2026
Summary
CVE-2021-47822 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Diskboss (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47822 is an unquoted service path vulnerability in DiskBoss Service version 12.2.18. The flaw exists in the service's binary path configuration, which fails to properly quote the path, allowing local attackers to execute arbitrary code with elevated privileges.
A local attacker with low privileges can exploit this vulnerability by placing a malicious executable in one of the potential path locations that the unquoted service path might traverse. Upon service startup, the malicious binary executes instead of the legitimate one, granting the attacker system-level access with high confidentiality, integrity, and availability impacts. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-428.
Advisories and related resources provide further details on the issue, including the vendor site at https://www.diskboss.com, a proof-of-concept exploit at https://www.exploit-db.com/exploits/49899, and a VulnCheck advisory at https://www.vulncheck.com/advisories/diskboss-service-diskbsaexe-unquoted-service-path.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2895
Vulnerability details
DiskBoss Service 12.2.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path by placing malicious executables in potential path locations to gain…
more
system-level access during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly enables path interception by unquoted path (T1574.009) for local privilege escalation on service start.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for services, including proper quoting of binary paths to directly prevent unquoted service path traversal exploits like CVE-2021-47822.
Requires timely identification, reporting, and correction of flaws such as the unquoted service path in DiskBoss Service to remediate CVE-2021-47822.
Applies least privilege to service accounts, limiting the impact of privilege escalation even if the unquoted path is exploited.