Cyber Posture

CVE-2021-47942

HighPublic PoC

Published: 16 May 2026

Published
16 May 2026
Modified
16 May 2026
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score N/A
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-47942 is a high-severity Path Traversal (CWE-22) vulnerability in Home Assistant Community Store (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

NVD Description

Home Assistant Community Store (HACS) 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh tokens, then craft…

more

valid JWT tokens to gain administrative access to Home Assistant instances.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-22

Affected Products

Home Assistant
Community Store
inferred from references and description; NVD did not file a CPE for this CVE

References