CVE-2019-15862

The CVE-2019-15862 issue affects CKFinder up to 2.6.2.1 across CKFinder for ASP, ASP.NET, ColdFusion, and PHP. The root cause is improper checks of file names that allow uploads of files without an extension even when a defined set of extensions is configured. Impact is remote unauthenticated upl...

CVE-2019-15891

CKFinder versions ≤ 2.6.2.1 and ≤ 3.5.0 are affected by a documentation issue that could mislead users into believing there is built‑in bulletproof content sniffing protection. The root cause is misleading documentation rather than a code flaw disclosed in these sources. Publicly available refere...

CVE-2016-20023

CKSource CKFinder for ASP.NET versions before 2.5.0.1 are affected. An authenticated user could download arbitrary server files by supplying the correct path, indicating an insecure path/file access mechanism. The issue impacts CKFinder’s file download functionality and could expose confidential ...

CVE-2025-63830

CKFinder v1.4.3 is vulnerable to Stored Cross-Site Scripting (XSS) due to a lack of proper sanitization in the File Upload function. An attacker can upload a specially crafted SVG file containing active content, such as [removed] tags, onload handlers, or elements. When a victim subsequently acc...