CVE-2021-34422

    Dashboard / Vulnerabilities / CVE-2021-34422

    CVE-2021-34422

    Published: 11 Nov 2021Last Modified: 8 Jul 2026

    Summary:

    Details: The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malicious user could upload a file to a shared folder with a specially crafted file name which could allow a user to execute an application which was not intended on their host machine. If a malicious user leveraged this issue with the public folder sharing feature of the Keybase client, this could lead to remote code execution.

    References: https://explore.zoom.us/en/trust/security/security-bulletin

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e3826b703a3df9c4bc041285e264f747da7795fa

    Affected versions

    v2.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-34422 | CVE-DB