CVE-2021-36233: The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticat

This month

MEDIUM 6.5DOWNGRADE

CVE-2021-36233 is a medium-severity flaw (CVSS 6.5) affecting mik.starlight. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the filesystem by specifying the file path.

Why this priority

Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	6.5 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	1.0% (top 37%)
CISA exploited list	No
Weakness	CWE-552
Published	2021-08-31
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: unit4

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2021-08-31 18:15 UTCPublished CVE record published
2026-06-17 03:58 UTCUpdated Record last modified

unit4 mik.starlight DOWNGRADE

Affected: 7.9.5.24363

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.9.5.24363

1. Check installed version

apt-cache policy mik.starlight || rpm -q mik.starlight || mik.starlight --version

2. No fixed release: DOWNGRADE to a release before 7.9.5.24363 (Debian / Ubuntu)

apt-cache madison mik.starlight sudo apt install mik.starlight=<VERSION_BEFORE_7.9.5.24363> sudo apt-mark hold mik.starlight

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list mik.starlight sudo dnf downgrade mik.starlight-<VERSION_BEFORE_7.9.5.24363> sudo dnf versionlock add mik.starlight

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-36233?

mik.starlight: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2021-36233 being exploited?

CVE-2021-36233 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-36233 affect?

CVE-2021-36233 affects mik.starlight. Severity is medium (CVSS 6.5). The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the filesystem by specifying the file path.

How urgent is CVE-2021-36233?

Priority 44/100. Public exploit reference

Related CVEs

CVE-2021-36234 MEDIUM 5.5 DOWNGRADE Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials v
CVE-2021-36232 HIGH 8.8 DOWNGRADE Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to
CVE-2021-36231 HIGH 8.8 DOWNGRADE Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remo

References

← Back to latest CVEs