GitHub Advisoryadvisory · Packagist

GHSA-7q88-jxvp-9gp2 Path Traversal in Studio-42 elFinder through 2.1.60

CRITICAL Published 2022-03-22 Modified 2023-07-07 Official page ↗
Aliases
CVE-2022-26960
Ecosystem
Packagist
Packages
studio-42/elfinder
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-22
Reviewed
2023-07-07

Affected packages

• Packagist studio-42/elfinder: < 2.1.61 → fixed in 2.1.61

Description

`connector.minimal.php` in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.

Related

Alias · CVE (1)

  • CVE-2022-26960 connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References