CVE-2021-27230

CVE-2021-27230 is a PHP Code Injection vulnerability affecting ExpressionEngine versions prior to 5.4.2 and 6.x prior to 6.0.3. Authenticated users can exploit this by leveraging the Translate::save() function to write malicious code to a _lang.php file, leading to high impact on confidentiality, integrity, and availability. With a CVSS score of 8.8 (High), this vulnerability is remotely exploitable with low attack complexity, requiring only low privileges. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.