critical9.8
CVE-2021-43421
elFinder Unrestricted File Upload vulnerability
Impact
A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via `connector.minimal.php`, which allows a remote malicious user to upload arbitrary files and execute PHP code.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | studio-42/elfinder | >= 2.0.4, < 2.1.60 | 2.1.60 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Std42 | Elfinder | from 2.0.4 through 2.1.59 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Studio-42/elFinder/issues/3429
- https://twitter.com/infosec_90/status/1455180286354919425
- https://github.com/advisories/GHSA-x4jx-hjwf-gc99
- https://nvd.nist.gov/vuln/detail/CVE-2021-43421
- https://github.com/Studio-42/elFinder/commit/c08bcbfa722d758d01975799b7036951eb5d33cb