GHSA-3h9f-mm2x-4j58

Studio 42 elFinder vulnerable to Incorrect Access Control

Source: GitHub Advisory Database (reviewed) High CVE-2024-38909

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	studio-42/elfinder	<= 2.1.64	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-38909 advisory
https://github.com/B0D0B0P0T/CVE/blob/main/CVE-2024-38909 web
https://github.com/Studio-42/elFinder package
http://elfinder.com web