Back to Database
Status published
High
CVE-2021-29100
ArcGIS Earth has a File Parsing Directory Traversal Vulnerability
Vulnerability Description
A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security context of the user running ArcGIS Earth by inducing the user to upload a crafted file to an affected system.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-29100
Credits & Attribution
No credits recorded in the NVD database.
References
More from Esri
View All →CVE-2025-67712
HTML injection issue in ArcGIS Web App Builder
Medium
4.7
CVE-2025-67711
Reflected XSS vulnerability in ArcGIS Server.
Medium
6.1
CVE-2025-67710
Stored XSS vulnerability in ArcGIS Server
Medium
6.1
CVE-2025-67709
There is a cross site scripting issue in ArcGIS Server.
Medium
6.1
CVE-2025-67708
Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.
Medium
6.1
Affected Vendor
Esri
View all reports →Affected Software
ArcGIS Earth
Vulnerable Versions:
1.11
Timeline
Official Publish:
May 5th, 2021
Last Modified:
April 10th, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H