CVE-2021-43176

CVE-2021-43176 is a critical path traversal vulnerability affecting the GOautodial API prior to commit 3c3a979, allowing an unauthenticated attacker to execute arbitrary PHP files on the server. This flaw arises from insufficient sanitization of the "action" parameter, which can be manipulated to load any PHP file present and readable by the web server. With a CVSS score of 8.8 (High), this vulnerability presents a significant risk of complete compromise (Confidentiality, Integrity, Availability) with low attack complexity and no user interaction required. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, indicating awareness within the security community.