CVE-2021-34685

Pentaho's UploadService tries to block dangerous uploads by extension but does it wrong: a plain ".jsp" file is rejected, yet a ".jsp." file — same name with a trailing dot — slips past the check and still lands as an executable JSP, giving remote code execution. The interesting twist is that despite that RCE outcome, the CVSS record scores it very low, because the vector treats it as requiring high privileges and yielding only limited integrity impact.

That gap between "leads to remote code execution" in the text and a 2.7 score is worth calling out honestly. The gating factor is that the attacker must be an authenticated user with upload rights already; this isn't an anonymous drop. So the realistic threat is an authorized-but-untrusted user, or a hijacked low-value account, escalating their existing access into code execution on the Pentaho server — a privilege-boundary bypass rather than a front-door breach.

Our read is to trust the impact over the raw score in the other direction: the number says 2.7, but the outcome is code execution, so we'd rank it above where a 2.7 normally sits while still noting the authentication precondition. Practically we'd inventory Pentaho instances through 9.1, prioritize any where upload permissions are broadly granted or the app is externally reachable, and where patching lags, watch for upload requests with trailing-dot or otherwise malformed extensions as a detection signature.