GHSA-7q88-jxvp-9gp2
Path Traversal in Studio-42 elFinder through 2.1.60
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | studio-42/elfinder | < 2.1.61 | 2.1.61 |
Details
As written in the advisory (Markdown source, shown as plain text).
`connector.minimal.php` in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
References
External links from the advisory. They lead to third-party sites.