{"id":"CVE-2021-45082","aliases":["GHSA-6cm4-gm85-972c","PYSEC-2022-37"],"title":"Command Injection in Cobbler","summary":"Command Injection in Cobbler","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"cobbler","product":"cobbler","ecosystem":"pip","affected":["cobbler < 3.3.1"],"patched":["cobbler 3.3.1"],"published":"2022-02-20","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:16.868270938Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6cm4-gm85-972c","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45082"},{"url":"https://github.com/cobbler/cobbler/pull/2945"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1193678"},{"url":"https://github.com/cobbler/cobbler"},{"url":"https://github.com/cobbler/cobbler/releases"},{"url":"https://github.com/cobbler/cobbler/releases/tag/v3.3.1"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cobbler/PYSEC-2022-37.yaml"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEJN7CPW6YCHBFQPFZKGA6AVA6T5NPIW"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z5CSXQE7Q4TVDQJKFYBO4XDH3BZ7BLAR"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCXMOUW4DH4DYWIJN44SMSU6R3CZDZBE"}],"tags":["osv","pip"],"epss":0.00495,"epssPercentile":0.39937,"ingestedAt":"2026-09-12T03:13:01.665Z","slug":"CVE-2021-45082","body":"## Overview\n\nAn issue was discovered in Cobbler through 3.3.0. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \"#from MODULE import\" substring. (Only lines beginning with #import are blocked.)\n\n## Affected packages\n\n- `cobbler < 3.3.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `cobbler 3.3.1`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}