CVE-2021-47942Disclosure(hacs / home_assistant_community_store)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh tokens, then craft valid JWT tokens to gain administrative access to Home Assistant instances.

hacs CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://www.exploit-db.com/exploits/49495

Vendor / third-party advisories

https://www.vulncheck.com/advisories/home-assistant-community-store-path-traversal-account-takeover

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

home_assistant_community_store

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

hacs

Products

home_assistant_community_store

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2021-47942

Full discourse1 post

CVE@CVEnew147d
Disclosure
CVE-2021-47942 Home Assistant Community Store (HACS) 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing direc… https://www.cve.org/CVERecord?id=CVE-2021-47942
Post summary
The post is a concise disclosure of CVE-2021-47942, a path traversal flaw in Home Assistant Community Store 1.10.0 that lets unauthenticated attackers read sensitive files, with no additional exploit, patch, or active usage details.
00000202
57.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	hacs	home_assistant_community_store	-	-	-

Explore more

Back to dashboard hacs CVEs home_assistant_community_store vulnerabilities