CVE-2018-9109 elFinder Path Traversal vulnerability
CriticalCVSS 9.1
EPSS 2.9%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Studio-42 elFinder(Packagist) | < 2.1.36 | 2.1.36 |
| Studio-42 elFinder(Packagist) | = 2.0.3 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.0.4 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.0.5 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.0.6 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.0.7 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.0.8 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.0.9 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.0 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.1 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.10 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.11 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.12 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.13 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.14 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.15 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.16 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.17 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.18 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.19 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.2 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.20 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.21 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.22 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.23 | No fix listed |
Show 20 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Studio-42 elFinder(Packagist) | = 2.1.24 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.25 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.26 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.27 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.28 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.29 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.3 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.30 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.31 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.32 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.33 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.34 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.35 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.4 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.5 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.6 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.7 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.8 | No fix listed |
| Studio-42 elFinder(Packagist) | = 2.1.9 | No fix listed |
| std42 elfinder | < 2.1.36 | 2.1.36 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com product
- github.com release-notes third-party-advisory
- github.com exploit mitigation third-party-advisory
- github.com