CVE-2021-47788
Published: 16 January 2026
Description
WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code execution on the server.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses unrestricted upload of dangerous types by validating language installation parameters to block arbitrary code execution.
Remediates the specific flaw in WebsiteBaker's language installation endpoint through timely identification, reporting, and patching.
Enforces least privilege to restrict language editing permissions, reducing the number of users able to access and exploit the vulnerable endpoint.
Security SummaryAI
CVE-2021-47788 is an authenticated remote code execution vulnerability in WebsiteBaker version 2.13.0. It affects the language installation endpoint, where users with language editing permissions can manipulate installation parameters to execute arbitrary code on the server. The vulnerability is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).
An attacker requires valid credentials and language editing permissions to exploit this issue over the network with low complexity and no user interaction. Successful exploitation grants high confidentiality, integrity, and availability impacts, enabling full remote code execution on the affected server.
Advisories and proof-of-concept exploits are documented on Exploit-DB (exploit ID 50310) and Vulncheck, with the official WebsiteBaker site at websitebaker.org providing additional context. Practitioners should verify patches or upgrades on the vendor site, as no specific mitigation details are outlined in the core CVE data.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2021-47788 is an authenticated RCE vulnerability in a public-facing web application (WebsiteBaker CMS) via unrestricted file upload in the language installation endpoint, directly mapping to exploitation of public-facing applications.