CVE-2021-40978
HIGH7.5EPSS 79.7%Directory traversal in mkdocs
Published: 10/12/2021Modified: 4/28/2026
Description
The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1
Affected packages (3)
- Debian/python-mkdocsfrom 0
- PyPI/mkdocs>= 1.2.2, < 1.2.3
- PyPI/mkdocs>= 1.2.2, < 1.2.3
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
References (11)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-40978
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2021-40978
- PATCHhttps://github.com/mkdocs/mkdocs
- WEBhttps://github.com/mkdocs/mkdocs/commit/1b15412f4caae476c262210315fd068d0521a833
- WEBhttps://github.com/mkdocs/mkdocs/commit/57540911a0d632674dd23edec765189f96f84f6b
- WEBhttps://github.com/mkdocs/mkdocs/issues/2601
- WEBhttps://github.com/mkdocs/mkdocs/pull/2604
- WEBhttps://github.com/mkdocs/mkdocs/releases/tag/1.2.3
- WEBhttps://github.com/nisdn/CVE-2021-40978
- WEBhttps://github.com/nisdn/CVE-2021-40978/issues/1
- WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/mkdocs/PYSEC-2021-878.yaml