by Kastro
Paper/Archive/CVE-2022-26960

CVE-2022-26960

mitre — connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal.

EPSS 51%CVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 98.9.989 × 2019.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refsynacktiv.com/publications.htmlrefgithub.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6dbrefsynacktiv.com/publications/elfinder-the-story-of-a-repwning.html