CVE-2021-29246

CVE-2021-29246 is a directory traversal vulnerability affecting BTCPay Server through version 1.0.7.0. An attacker with administrative privileges can exploit this flaw by uploading a specially crafted malicious plugin file, allowing them to write files outside the intended directory. This vulnerability carries a CVSS score of 6.7 (Medium), indicating that an attacker can achieve high confidentiality, integrity, and availability impact with low attack complexity, but requires high privileges and local access. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.