CVE-2021-44162— Chain Sea Information Integration Co., Ltd ai chatbot system - Path Traversal
Quick assessment
Affected
Chain Sea Information Integration Co., Ltd ai chatbot system
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Chain Sea Ai Chatbot System是中国程曦资讯（Chain Sea）公司的一个智能人工客服软件。 Chain Sea Ai Chatbot System 中存在路径遍历漏洞，该漏洞源于产品的特定文件下载功能未对URL参数中的特殊字符进行过滤。攻击者可通过该漏洞进行在不进行认证的情况下下载任意系统文件。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-44162
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Chain Sea Information Integration Co., Ltd ai chatbot system - Path Traversal
Source: CVE Program / CVE List V5
Vulnerability Description
Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of special characters in URL parameters, which allows a remote attacker to download arbitrary system files without authentication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Chain Sea Ai Chatbot System 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Chain Sea Ai Chatbot System是中国程曦资讯（Chain Sea）公司的一个智能人工客服软件。 Chain Sea Ai Chatbot System 中存在路径遍历漏洞，该漏洞源于产品的特定文件下载功能未对URL参数中的特殊字符进行过滤。攻击者可通过该漏洞进行在不进行认证的情况下下载任意系统文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Chain Sea Information Integration Co., Ltd | ai chatbot system | 0 | - |
|
II. Public POCs for CVE-2021-44162
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-44162
请登录查看更多情报信息。
Other References for CVE-2021-44162 (1)
-
https://www.twcert.org.tw/tw/cp-132-5397-b1f40-1.html x_refsource_MISC
Same Patch Batch · Chain Sea Information Integration Co., Ltd · 2021-12-20 · 3 CVEs total
| CVE-2021-44164 | 9.8 CRITICAL | Chain Sea Information Integration Co., Ltd ai chatbot system - Arbitrary File Upload |
| CVE-2021-44163 | 6.1 MEDIUM | Chain Sea Information Integration Co., Ltd ai chatbot system - Reflected XSS |
IV. Related Vulnerabilities
Same weakness: CWE-22
-
CVE-2026-82460
Cloud Commander before 19.20.2 Directory Traversal via REST -
CVE-2026-18899
Langflow is affected by multiple authentication bypass, path -
CVE-2026-55552
Yamcs: Unauthenticated Directory Traversal -
CVE-2026-55569
aqua: Archive extraction in aqua follows attacker-planted sy -
CVE-2026-82286
gpt-crawler Arbitrary File Write via outputFileName Paramete
V. Comments for CVE-2021-44162
No comments yet