Std42

Records16All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Std42 records in CISA KEV

No Std42 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Elfinder 16 records CRITICAL

Records

16 records in Elfinder · all components

TI-2019-06652 CVE-2019-9194 · GHSA-4223-qj94-7x9p

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

CRITICAL 86

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.9673 Published 2019-02-26 Fixed in 2.1.48 CWE-78

TI-2023-28504 CVE-2023-52044 · GHSA-jh2f-6jmr-qxf8

Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no…

HIGH 82

Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0079 Published 2024-10-31 No fix listed CWE-434

TI-2021-12350 CVE-2021-32682 · GHSA-wph3-44rj-92pr

Multiple vulnerabilities leading to RCE

HIGH 79

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.69934 Published 2021-06-14 Fixed in 2.1.59 CWE-22

TI-2022-10186 CVE-2022-26960 · GHSA-7q88-jxvp-9gp2

connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal.

HIGH 71

connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.50993 Published 2022-03-21 Fixed in 2.1.61 CWE-22

TI-2021-19360 CVE-2021-43421 · GHSA-x4jx-hjwf-gc99

A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via…

HIGH 71

A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.42781 Published 2022-04-07 Fixed in 2.1.60 CWE-434

TI-2022-10265 CVE-2022-27115 · GHSA-6p96-vfrc-fv32

In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution…

HIGH 65

In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.28594 Published 2022-04-11 Fixed in 2.1.61 CWE-434

TI-2023-17916 CVE-2023-35840 · GHSA-wm5g-p99q-66g4

_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows…

MEDIUM 62

_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01936 Published 2023-06-19 Fixed in 2.1.62 CWE-22

TI-2023-28505 CVE-2023-52045 · GHSA-mq5w-h63c-48mj

Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent…

MEDIUM 60

Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00289 Published 2024-10-31 No fix listed CWE-79

TI-2021-06087 CVE-2021-23394 · GHSA-qm58-cvvm-c5qr

Remote code execution (RCE) in studio-42/elfinder

MEDIUM 60

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.18935 Published 2021-06-13 Fixed in 2.1.58 CWE-434

TI-2024-26104 CVE-2024-38909 · GHSA-3h9f-mm2x-4j58

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control.

MEDIUM 49

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0048 Published 2024-07-30 No fix listed CWE-284

TI-2018-06615 CVE-2018-9110 · GHSA-44p8-c3wv-f28r

Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in…

MEDIUM 45

Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0288 Published 2018-03-28 Fixed in 2.1.37 CWE-22

TI-2018-06614 CVE-2018-9109 · GHSA-45x3-mw7q-wf7f

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in…

MEDIUM 45

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02944 Published 2018-03-28 Fixed in 2.1.36 CWE-22

TI-2026-29856 CVE-2026-41247 · GHSA-8q4h-8crm-5cvc

elFinder: Command injection in resize background color parameter when using ImageMagick CLI

MEDIUM 44

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.01569 Published 2026-04-23 Fixed in 2.1.67 CWE-78

TI-2019-04451 CVE-2019-6257 · GHSA-3qhm-qfj3-4rrx

A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow…

LOW 36

A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01098 Published 2019-01-14 Fixed in 2.1.49 CWE-918

TI-2019-04195 CVE-2019-5884 · GHSA-jcgc-vxqg-85xx

php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl…

LOW 29

php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01275 Published 2019-01-10 Fixed in 2.1.45 CWE-200

TI-2021-20928 CVE-2021-45919 · GHSA-c3j8-q5x6-2855

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.

LOW 25

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00626 Published 2022-02-08 No fix listed CWE-79

Open these records in search →

Critical	10
High	2
Medium	4
Low	0
No CVSS	0