CVE-2023-52044

Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution RCE as there is no restriction for uploading files with the .php8 extension...

PT-2024-14373 · Studio 42 · Elfinder

Name of the Vulnerable Software and Affected Versions: Studio-42 eLfinder versions 2.1.62 and prior Description: The issue is related to Remote Code Execution RCE due to the lack of restriction for uploading files with the .php8 extension. This allows users to upload malicious files, potentially...

elFinder 安全漏洞

elFinder is an open source web file manager from Studio 42 Open Source. A security vulnerability exists in elFinder version 2.1.62, which stems from the inclusion of a filename restriction bypass vulnerability that can lead to a persistent cross-site scripting vulnerability...

CVE-2023-52045

CVE-2023-52045 affects Studio-42 elFinder 2.1.62, where a filename restriction bypass leads to a persistent XSS vulnerability. Impact: stored XSS via crafted filenames; context is in elFinder file handling. Remediation: upgrade to elFinder 2.1.63 or higher (as reported by Snyk/Veracode/Red Hat re...

CVE-2023-52045

Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting XSS vulnerability...

CVE-2023-52044

Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution RCE as there is no restriction for uploading files with the .php8 extension...

Exploit for Path Traversal in Std42 Elfinder

CVE-2023-35840 elFinder 2.1.62 - Path Traversal vulnerabilit...

CVE-2023-35840

joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector...

GHSA-WM5G-P99Q-66G4 elFinder vulnerable to path traversal in LocalVolumeDriver connector

Impact Path Traversal vulnerability in PHP LocalVolumeDriver connector. This vulnerability can be exploited by allowing untrusted users to write to the local file system. This issue was caused by incomplete validity checking of the supplied request parameters. That problem has been fixed in...

PT-2023-25338 · Elfinder · Elfinder

Name of the Vulnerable Software and Affected Versions: elFinder versions prior to 2.1.62 Description: The issue allows path traversal in the PHP LocalVolumeDriver connector due to incomplete validity checking of supplied request parameters. This can be exploited by allowing untrusted users to wri...