CVE-2021-31865

Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments...

CVE-2021-31865

CVE-2021-31865 affects Redmine: arbitrary filename extension upload bypass in Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1. The issue is mitigated by upgrading to Redmine 4.2.1 or later (upstream fixes confirmed by multiple advisories). If upgrading, ensure the target version ...