Skip to content
OpenAdvisories

Package · Packagist

studio-42/elfinder

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-81890

    elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

    elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for th…

    Studio-42 elFinder studio-42/elfinder Packagist
  • Medium 6.5
    CVE-2023-35840 Public exploit

    elFinder vulnerable to path traversal in LocalVolumeDriver connector

    _joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.

    studio-42/elfinder Packagist
  • Medium 5.4
    CVE-2021-45919

    Studio 42 elFinder allows stored XSS

    Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.

    studio-42/elfinder Packagist
  • Medium 5.9
    CVE-2019-5884

    Sensitive Data Exposure in elFinder

    php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.

    studio-42/elfinder Packagist