connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
References
Link | Resource |
---|---|
https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db | Patch Third Party Advisory |
https://www.synacktiv.com/publications.html | Product |
https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html | Exploit Technical Description Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-03-21T16:52:38
Updated: 2022-03-30T22:35:07
Reserved: 2022-03-12T00:00:00
Link: CVE-2022-26960
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-03-21T17:15:07.740
Modified: 2022-06-30T19:47:16.823
Link: CVE-2022-26960
JSON object: View
Redhat Information
No data.
CWE