CVE-2021-40978
mediumpriority · attend · 45EPSS 0.151 · 97 %ileexploit · PoCEUUSEPSS · scored 2026-10-27
The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- nisdn/CVE-2021-40978nisdn/CVE-2021-40978PoC · poc_in_github
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-qh9q-34h6-hcv9Directory traversal in mkdocs2021-10-12ghsa · osvUS
The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information.
- PYSEC-2021-8782021-10-07vendor · osvUS
The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://github.com/mkdocs/mkdocs/issues/2601cnnvd
- https://github.com/nisdn/CVE-2021-40978cnnvd
- https://github.com/nisdn/CVE-2021-40978/issues/1cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-40978cnnvd
- https://github.com/mkdocs/mkdocsenisa_euvd
- https://github.com/mkdocs/mkdocs/issues/2601enisa_euvd
- https://github.com/nisdn/CVE-2021-40978enisa_euvd
- https://github.com/nisdn/CVE-2021-40978/issues/1enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan