CVE-2021-41790

Alfresco Content Services lets a script action execute scripts that were uploaded outside the Data Dictionary, so a logged-in user can run arbitrary code — but inside a sandboxed environment. Two qualifiers shape this precisely: the attacker must be authenticated, and the execution is confined to a sandbox rather than free rein on the host. It's an escape of the intended "only run scripts from the trusted Data Dictionary" boundary by an authorized user.

Because it requires a valid low-privileged login and lands in a sandbox, the realistic threat is an authenticated insider or a compromised user account escalating what they can do within the content platform, not an anonymous remote takeover. The value to an attacker is code execution against a document-management system that often holds sensitive business content and integrates with identity and storage systems — a strong pivot point — but the authentication requirement and sandboxing are meaningful brakes that keep this off the critical-panic tier.

Our angle is to weigh who holds accounts and whether the platform is externally reachable. We'd inventory Alfresco Content Services through 7.0.1.2, prioritizing instances exposed beyond the corporate network or with broad self-registration, since those widen the pool of "logged-in attackers." It patches on the vendor line; where that lags, we'd tighten who can invoke script actions and monitor for script execution originating outside the Data Dictionary as the abuse signature.