Directory Traversal in elFinder.AspNet

ALTO 7.5CVE-2021-23415 · GHSA-pjxv-w3qj-j8m3 · SNYK-DOTNET-ELFINDERASPNET-1315153 · Published 28/07/2021 · updated 17/06/2026

In breve

CVE-2021-23415 è una vulnerabilità ALTO (CVSS 7.5) che riguarda elFinder.AspNet, elfinder.aspnet (elfinder.aspnet project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.7%, superiore al 77.8% delle vulnerabilità.
Correzione: aggiornare a 1.1.1 o successiva.

Package	Affected versions	Patched versions
elFinder.AspNet NuGet	`< 1.1.1`	`1.1.1`
elfinder.aspnet elfinder.aspnet_project	`< 1.1.1`	`1.1.1`

Description

This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.

NVD description

This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.

References

nvd.nist.gov/vuln/detail/CVE-2021-23415 · ADVISORY
mguinness/elFinder.AspNet commit 675049b · WEB
mguinness/elFinder.AspNet · PACKAGE
snyk.io/vuln/SNYK-DOTNET-ELFINDERASPNET-1315153 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free