Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-41764

A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a CSRF attack and send them to the attacker.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-41764
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:21 UTC · Revision 1

Source evidence

CVE-2021-41764

core-osv · Original source

Published 29 Sept 2021, 20:15 UTC

A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a CSRF attack and send them to the attacker.

osv:CVE-2021-41764
Complete source record
{
  "id": "c72744448853b2bbed0b47dacc133d162920e994c665f39d9ec325db10fd30e1",
  "url": "https://osv.dev/vulnerability/CVE-2021-41764",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-41764",
    "summary": "A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a CSRF attack and send them to the attacker.",
    "evidence": "osv:CVE-2021-41764",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2021-41764",
      "aliases": [
        "CVE-2021-41764"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/streamaserver/streama",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "845d2a3a31552e79872052a3c293807224164be5"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:streama_project:streama:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.10.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.10.3",
            "v1.10.2",
            "v1.10.1",
            "v1.10.0",
            "v1.9.3",
            "v1.9.2",
            "v1.8.3",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0-beta",
            "v1.7.3",
            "v1.7.2",
            "v1.7.1",
            "v1.7.0",
            "v1.7.0-RC13",
            "v1.7.0-RC12",
            "v1.7.0-RC11",
            "v1.7.0-RC10",
            "v1.7.0-RC9",
            "v1.7.0-RC8",
            "v1.7.0-RC6",
            "v1.7.0-RC5",
            "v1.7.0-RC3",
            "v1.7.0-RC7",
            "v1.7.0-RC4",
            "v1.7.0-RC2",
            "v1.7.0-RC1",
            "v1.6.7",
            "v1.6.6",
            "v1.6.5",
            "v1.6.4",
            "v1.6.3",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0-FINAL",
            "v1.6.0-RC10",
            "v1.6.0-RC9",
            "v1.6.0-RC8",
            "v1.6.0-RC7",
            "v1.6.0-RC6",
            "v1.6.0-RC5",
            "v1.6.0-RC4",
            "v1.6.0-RC3",
            "v1.6.0-RC2",
            "v1.6.0-RC1",
            "v1.5.2",
            "v1.5.1",
            "v1.4.2",
            "v1.4.1RC3",
            "v1.4.0_beta",
            "1.3.3_beta",
            "v1.3.2_beta",
            "1.3.1_beta",
            "v1.3.0_beta",
            "v1.2.3_beta",
            "v1.2.1_beta",
            "v1.2_beta",
            "v1.1",
            "v1.0.19",
            "v1.0.18",
            "v1.0.17",
            "v1.0.16",
            "v1.0.15",
            "v1.0.14",
            "v1.0.13",
            "v1.0.12",
            "v1.0.11",
            "v1.0.10",
            "v0.3.2",
            "v0.3.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41764.json"
          }
        }
      ],
      "modified": "2026-10-20T10:54:02.598228589Z",
      "provider": "osv",
      "references": [
        "https://gist.github.com/omriinbar/8277193731d0edf20ef71299f304ab93",
        "https://github.com/streamaserver/streama",
        "https://gist.github.com/omriinbar/3c741d309e5d0ede29dc7ecdad4eba3f"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-41764",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 384826,
  "published_at": "2021-09-29T20:15:08.703+00:00"
}