GHSA-wmpm-fq7r-jq56

Imporoper path validation in elFinder.NetCore

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23427

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	elFinder.NetCore	<= 1.3.5	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23427 advisory
https://github.com/gordon-matt/elFinder.NetCore package
https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystem… web
https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystem… web
https://snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1567778 web