CVE-2021-27850

CVE-2021-27850 is a critical unauthenticated remote code execution (RCE) vulnerability affecting Apache Tapestry versions 5.4.5, 5.5.0, 5.6.2, and 5.7.0. This flaw allows an attacker to bypass a previous fix (CVE-2019-0195) by appending a slash to a crafted URL, enabling the download of sensitive class files containing HMAC secret keys. With this key, an attacker can sign serialized Java objects to achieve RCE. The vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. Its high EPSS score of 0.942190 and FAUCET Risk Score of 100/100 indicate a significant likelihood of exploitation. While not listed on the KEV catalog or Hot List, exploit intelligence shows available Metasploit modules and Nuclei templates, suggesting readily available exploit code. Despite this, there is currently no recorded community discussion or media coverage for this CVE.