TI-2021-06087 Aliases CVE-2021-23394 GHSA-qm58-cvvm-c5qr

Remote code execution (RCE) in studio-42/elfinder

MEDIUM 60CWE-434Published 2021-06-13 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.

Why it matters now

EPSS 0.18935 97th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed studio-42/elfinder: 2.1.58studio-42/elfinder (Packagist): 2.1.58

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	studio-42/elfinder	before 2.1.58	2.1.58	Patch available	CNA
—	studio-42/elfinder (Packagist)	before 2.1.58	2.1.58	Patch available	GHSA-qm58-cvvm-c5qr

studio-42/elfinder Vendor— Affected before 2.1.58 Fixed in 2.1.58 Patch available CNA
studio-42/elfinder (Packagist) Vendor— Affected before 2.1.58 Fixed in 2.1.58 Patch available GHSA-qm58-cvvm-c5qr

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:std42:elfinder::::::::	before 2.1.58	Vulnerable	Std42

cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:* Versions before 2.1.58 Vulnerable ·Std42

Remediation

Fix · CNA studio-42/elfinder Fixed in 2.1.58
Fix · GHSA-qm58-cvvm-c5qr studio-42/elfinder (Packagist) Fixed in 2.1.58 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-23394
2026-10-03 Alias added: GHSA-qm58-cvvm-c5qr

References

Exploit 2

Patch 1

https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1

Advisory 2

Other 2

TI-2019-06652 elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. CVSS 3.0CRITICAL 9.8
TI-2023-28504 Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no… CVSS 3.1CRITICAL 9.8
TI-2021-12350 Multiple vulnerabilities leading to RCE CVSS 3.1CRITICAL 9.8
TI-2022-10186 connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. CVSS 3.1CRITICAL 9.1
TI-2021-19360 A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via… CVSS 3.1CRITICAL 9.8
TI-2022-10265 In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution… CVSS 3.1CRITICAL 9.8

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences