Vulnerability · Published Sep 1, 2021 · Assigned by snyk
CVE-2021-23428Directory Traversal
High 8.6
In plain English
A high-severity security flaw in elFinder.NetCore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)1.7%top 23.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | elfinder.netcore | no fix listed | GHSA-9rjp-r58j-fxgq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | elFinder.NetCore | 0 – before unspecified |
References
- https://snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1313838 x_refsource_MISC
- https://github.com/gordon-matt/elFinder.NetCore x_refsource_MISC
- https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystemDriver.cs%23L387 x_refsource_MISC