Files Accessible to External Parties in Opencast

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.9 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

• CVE-2021-43821: 2.03% estimated exploitation activity in the next 30 days; percentile 81.05 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Opencast before version 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface. Impact Before Opencast 10.6, Opencast would open and include local files during ingests. Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine. For example, to expose the custom.properties of develop.opencast.org via the asset manager, an attacker could have run: An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given. Patches The issue has been fixed in Opencast 10.6 and 11.0. Workarounds You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we…

Published by the source

14 Dec 2021, 21:44 UTC

Last modified by the source

1 Feb 2023, 05:07 UTC

Source last checked

26 Oct 2026, 16:07 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-59g4-hpg3-3gcp

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2021-43821

Advisory: Files Accessible to External Parties in Opencast
IDs: CVE-2021-43821, GHSA-59g4-hpg3-3gcp
Record: https://patchnext.com/advisories/cve-2021-43821 (revision 1, source checked 26 Oct 2026, 16:07 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.9)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: org.opencastproject:opencast-ingest-service-impl 10.6. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven org.opencastproject:opencast-ingest-service-impl: affected < 10.6; fixed in 10.6

## Suggested inspection (read-only)
- Maven org.opencastproject:opencast-ingest-service-impl: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on org.opencastproject:opencast-ingest-service-impl.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-59g4-hpg3-3gcp (GitHub-reviewed advisory GHSA-59g4-hpg3-3gcp lists affected ranges: Maven org.opencastproject:opencast-ingest-service-impl >=0 <10.6)

Commands are suggestions: review each one before running it.