GitHub Advisoryadvisory · Packagist

GHSA-wm5g-p99q-66g4 elFinder vulnerable to path traversal in LocalVolumeDriver connector

HIGH Published 2023-06-14 Modified 2023-06-19 Official page ↗
Aliases
CVE-2023-35840
Ecosystem
Packagist
Packages
studio-42/elfinder
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2023-06-14

Affected packages

• Packagist studio-42/elfinder: < 2.1.62 → fixed in 2.1.62

Description

Impact Path Traversal vulnerability in PHP LocalVolumeDriver connector. This vulnerability can be exploited by allowing untrusted users to write to the local file system. This issue was caused by incomplete validity checking of the supplied request parameters. That problem has been fixed in elFinder Version 2.1.62. Patches This vulnerability has been fixed in elFinder 2.1.62. Installation managers should update to the latest version as soon as possible. Workarounds If you cannot update for some reason, you must stop using it or prohibit writing to untrusted users.

Related

Alias · CVE (1)

  • CVE-2023-35840 _joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References