10 matches found
CVE-2019-9194
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
CVE-2021-32682
elFinder 2.1.58 is affected by multiple remote code execution vulnerabilities that could allow an attacker to execute arbitrary code and commands on the server hosting the PHP connector, even with minimal configuration. The issues were patched in 2.1.59; a mitigation is to ensure the connector is...
CVE-2022-26960
CVE-2022-26960 affects elFinder
CVE-2021-23394
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
CVE-2019-5884
The CVE-2019-5884 entry concerns information disclosure in the elFinder project. It affects elFinder versions up to and including 2.1.44 (before 2.1.45), where PHP’s curl extension, combined with unsafe PHP configurations (safe_mode or open_basedir not set), can leak information. Root cause is ti...
CVE-2023-35840
CVE-2023-35840 affects elFinder before 2.1.62 due to a path traversal weakness in the PHP LocalVolumeDriver connector (joinPath in elFinderVolumeLocalFileSystem.class.php). The root cause is incomplete validation of the target parameter, allowing traversal beyond web root. OpenVAS details indicat...
CVE-2019-6257
The CVE-2019-6257 issue affects elFinder prior to version 2.1.46, caused by a vulnerability in get_remote_contents() within php/elFinder.class.php that permits server-side request forgery (SSRF) to access internal network resources. Public documents from NVD, Red Hat, OSV, and security advisories...
CVE-2018-9110
Studio 42 elFinder is vulnerable before version 2.1.37 due to a directory traversal flaw in elFinder.class.php zipdl() that lets an attacker download files accessible to the web server and delete files owned by the server process. The issue stems from an incomplete fix for CVE-2018-9109. Public r...
CVE-2018-9109
Studio 42 elFinder (PHP Web file manager) prior to version 2.1.36 is affected by a directory traversal vulnerability in elFinder.class.php, zipdl() function. The flaw allows a remote attacker to download files accessible by the web server process and to delete files owned by the account running t...