Path Traversal in elFinder.Net.Core

HOCH 7.5CVE-2021-23407 · GHSA-mvvp-gwgc-5hrp · SNYK-DOTNET-ELFINDERNETCORE-1315152 · Published 14/07/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-23407 ist eine Schwachstelle (HOCH (CVSS 7.5)) in elFinder.Net.Core, elfinder.net.core (elfinder.net.core project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.0%, höher als bei 80.8% aller Schwachstellen.
Abhilfe: auf 1.2.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
elFinder.Net.Core NuGet	`< 1.2.4`	`1.2.4`
elfinder.net.core elfinder.net.core_project	`< 1.2.4`	`1.2.4`

Description

This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path.

NVD description

This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path.

References

nvd.nist.gov/vuln/detail/CVE-2021-23407 · ADVISORY
trannamtrung1st/elFinder.Net.Core commit 5498c8a · WEB
trannamtrung1st/elFinder.Net.Core · PACKAGE
trannamtrung1st/elFinder.Net.Core release all-1.2.4 · WEB
snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1315152 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free