GitHub Advisoryadvisory · Packagist

GHSA-x4jx-hjwf-gc99 elFinder Unrestricted File Upload vulnerability

CRITICAL Published 2022-04-08 Modified 2024-01-10 Official page ↗
Aliases
CVE-2021-43421
Ecosystem
Packagist
Packages
studio-42/elfinder
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2024-01-10

Affected packages

• Packagist studio-42/elfinder: >= 2.0.4, < 2.1.60 → fixed in 2.1.60

Description

A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via `connector.minimal.php`, which allows a remote malicious user to upload arbitrary files and execute PHP code.

Related

Alias · CVE (1)

  • CVE-2021-43421 A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References