CVE

CVE-2021-26294

7.5

CVSS

Description

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).

Attack Vector

Privileges Req.

User Interaction

Updated Sep 26, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

CVE-2021-26294 Scanner

CVE-2021-26294 scanner - Information Disclosure vulnerability in AfterLogic Aurora and WebMail Pro

Used 3k times · 3.3k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →