# ❗ Security vulnerability in Listary \[CVE-2021-41066\]

**URL:** <https://discussion.listary.com/t/security-vulnerability-in-listary-cve-2021-41066/9641>\
**Category:** Bug Reports\
**Created:** [December 11, 2024, 8:01am UTC](https://discussion.listary.com/t/security-vulnerability-in-listary-cve-2021-41066/9641 "2024-12-11T08:01:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![listary\_sev](https://discussion.listary.com/letter_avatar_proxy/v4/letter/l/258eb7/32.png) [@listary\_sev](https://discussion.listary.com/u/listary_sev)\
**Post date:** [December 11, 2024, 8:01am UTC](https://discussion.listary.com/t/security-vulnerability-in-listary-cve-2021-41066/9641/1 "2024-12-11T08:01:12Z")

</div>

> **[CVE-2021-41066 - Listary UAC Bypass Unrestricted File Access Vulnerability](https://cvefeed.io/vuln/detail/CVE-2021-41066)**
>
> An issue was discovered in Listary through 6. When Listary is configured as admin, Listary will not ask for permissions again if a user tries to access files on the system from Listary itself (it will bypass UAC protection; there is no privilege...

> [@](#):
>
> An issue was discovered in Listary through 6. When Listary is configured as admin, Listary will not ask for permissions again if a user tries to access files on the system from Listary itself (it will bypass UAC protection; there is no privilege validation of the current user that runs via Listary).

and

> [@](#):
>
> An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation of update packages that can cause an installation of malicious content.

I don’t care about the MITM attack, but the lack of package validation and automatic escalation of UAC privileges is very, very concerning.

What this effectively means that if you accidentally run malware through Listary, it will automatically inherit the admin priv and potentially ransomware your computer.

This vulnerability exists in all versions of Listary, including v6.  
The reason I found this is because I just experienced this on my own computer and was wondering why some software were running with “Full Elevation” in process manager. I tracked it down to Listary. Winamp among other software actually broke because they were running in full admin without any user interaction.

I love Listary, especially the new version, but this seems like an unacceptable security risk.

@Channing This was reported to Bopsoft several times. Is there a response to this?

---

<div class="post-metadata">

**Author:** ![horst](https://discussion.listary.com/letter_avatar_proxy/v4/letter/h/edb3f5/32.png) [@horst](https://discussion.listary.com/u/horst)\
**Post date:** [December 11, 2024, 3:17pm UTC](https://discussion.listary.com/t/security-vulnerability-in-listary-cve-2021-41066/9641/2 "2024-12-11T15:17:33Z")

</div>

The normal set-up of Listary has no such problems.  
Running it as Admin is not suggested and not necessary  
for its designed functions.  
None of my processes started for Listary runs with elevated rights.

* * *

Windows 11 Home Version 24H2 (OS Build 26100.2605)  
Listary Pro 6.3.1.84

---

<div class="post-metadata">

**Author:** ![listary\_sev](https://discussion.listary.com/letter_avatar_proxy/v4/letter/l/258eb7/32.png) [@listary\_sev](https://discussion.listary.com/u/listary_sev)\
**Post date:** [December 12, 2024, 6:58am UTC](https://discussion.listary.com/t/security-vulnerability-in-listary-cve-2021-41066/9641/3 "2024-12-12T06:58:15Z")

</div>

It looks like it happens when you run Listary without the Listary service installed (ie. portable mode).

It’s also reproducible in Portable Listary hosted here: [Listary Portable (find-as-you-type search utility) | PortableApps.com](https://portableapps.com/apps/utilities/listary_portable)

---

<div class="post-metadata">

**Author:** ![Channing](https://discussion.listary.com/user_avatar/discussion.listary.com/channing/32/5497_2.png) [@Channing](https://discussion.listary.com/u/Channing)\
**Post date:** [December 22, 2024, 1:42pm UTC](https://discussion.listary.com/t/security-vulnerability-in-listary-cve-2021-41066/9641/4 "2024-12-22T13:42:30Z")

</div>

Hi @listary_sev ,

Thank you for reporting this issue. We strongly recommend using the official [installer version](https://dl.listary.net/Listary.exe). In this version, Listary runs with standard privileges, and processes launched by Listary are detached, meaning they won’t inherit privileges or environment variables.

Additionally, we have previously migrated our update server to HTTPS.