Skip to content
OpenAdvisories

Package · Packagist

studio-42/elfinder

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-38909

    Studio 42 elFinder vulnerable to Incorrect Access Control

    Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.

    studio-42/elfinder Packagist
  • Critical 9.8
    CVE-2022-27115 EPSS 29%

    RCE in Studio-42 elFinder on Windows before 2.1.61

    In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.

    studio-42/elfinder Packagist
  • Critical 9.8
    CVE-2021-43421 Scanner template EPSS 43%

    elFinder Unrestricted File Upload vulnerability

    A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.

    studio-42/elfinder Packagist
  • Critical 9.1
    CVE-2022-26960 Scanner template EPSS 51%

    Path Traversal in Studio-42 elFinder through 2.1.60

    connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.

    studio-42/elfinder Packagist
  • Critical 9.8
    CVE-2021-32682 Public exploit Scanner template EPSS 68%

    Multiple vulnerabilities leading to RCE

    elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP c…

    Studio-42 elFinder studio-42/elfinder Packagist
  • Critical 9.8
    CVE-2019-9194 Public exploit Scanner template EPSS 97%

    elFinder command injection vulnerability in the PHP connector

    elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

    studio-42/elfinder Packagist
  • Critical 9.1
    CVE-2018-9110

    Directory Traversal in Studio 42 elFinder

    Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the …

    studio-42/elfinder Packagist
  • Critical 9.1
    CVE-2018-9109

    elFinder Path Traversal vulnerability

    Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the …

    studio-42/elfinder Packagist