GitHub Advisoryadvisory · Packagist

GHSA-6p96-vfrc-fv32 RCE in Studio-42 elFinder on Windows before 2.1.61

CRITICAL Published 2022-04-12 Modified 2023-07-07 Official page ↗

Aliases: CVE-2022-27115
Ecosystem: Packagist
Packages: studio-42/elfinder
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-434
Reviewed: 2023-07-07

Affected packages

• Packagist studio-42/elfinder: < 2.1.61 → fixed in 2.1.61

Description

In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.

Related

Alias · CVE (1)

CVE-2022-27115 In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload. vulnerability

Weakness · CWE (1)

CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References