Remote Code Execution

studio-42/elfinder is vulnerable to remote code execution. An attacker is able to execute arbitrary code and commands on the server hosting the elFinder PHP connector even with the minimal configuration...

CVE-2021-23394

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP...

Remote code execution

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP...

CVE-2021-23394 Remote Code Execution (RCE)

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP...

CVE-2021-23394

The studio-42/elfinder web file manager before version 2.1.58 is vulnerable to Remote Code Execution (RCE) . The root cause is an insufficient upload filter that fails to disallow the upload of .phar files. If the underlying web server (such as certain Apache or Nginx configurations) parses these...

CVE-2021-23394: Unrestricted Upload of File with Dangerous Type

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP...

Information Disclosure

studio-42/elfinder is vulnerable to information disclosure. An attacker is able to obtain confidential information when the PHP's curl extension, and when safemode or openbasedir is not configured...

Studio 42 elFinder Directory Traversal Vulnerability

Studio 42 elFinder is an open source Web file manager using jQuery and jQuery UI and written in JavaScript . A directory traversal vulnerability exists in Studio 42 elFinder. An attacker can exploit this vulnerability by deleting files with the 'zipdl' function in the elFinder.class.php file...

CVE-2018-9110

Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue...

CVE-2018-9110: Improper Limitation of a Pathname to a Restricted Directory

Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue...

CVE-2018-9109: Improper Limitation of a Pathname to a Restricted Directory

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process...

PT-2018-18858

Name of the Vulnerable Software and Affected Versions Studio 42 elFinder versions prior to 2.1.36 Studio 42 elFinder version 2.1.36 Description The issue is a directory traversal vulnerability in elFinder.class.php with the zipdl function. This vulnerability can allow a remote attacker to downloa...