Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
15 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP endpoint in the victim's session and cause the server to initiate an outbound FTP connection without the X-elFinder-CSRF token that other state-changing commands require. This was confirmed locally against Studio-42/elFinder at commit ec5f811dc321a053085b994966f553eaaab58721, corresponding to the repository's documented stable release 2.1.69 / API revision 2.1.69. Details The connector has an explicit allowlist of commands that require CSRF validation in php/elFinderConnector.class.php:79-92. That list includes state-changing commands such as mkdir, mkfile, paste, put, rename, rm, upload, archive, extract, resize, and chmod, but it omits netmount. The enforcement point in…
Recommended action: Upgrade to 2.1.70 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
poc.zip Summary elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass when PHP cURL is unavailable and URL uploads use the fsockgetcontents() fallback. An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially resolves to an allowed public IP address and subsequently resolves to a loopback or private IP address. The URL validation checks the first resolved IP, but fsockgetcontents() opens the actual connection using the original hostname. This causes a second DNS resolution and allows the connection to reach an address different from the one that was validated. The response from the internal service is saved as an uploaded file and can be read through elFinder. This makes the demonstrated issue a non-blind SSRF. The most accurate classification is: Vulnerability: SSRF protection bypass Exploitation technique: DNS rebinding Root cause: TOCTOU/double DNS resolution without IP pinning Affected…
Recommended action: Upgrade to 2.1.70 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An authenticated SQL injection vulnerability in the elFinder MySQL volume driver (elFinderVolumeMySQL) allows any logged-in user, including users with read-only access to the affected volume, to inject SQL through a crafted target file hash. Successful exploitation can lead to unauthorized data disclosure and denial of service. This vulnerability only affects installations configured to use the MySQL volume driver. Installations using the default LocalFileSystem driver are not affected. Description A vulnerability in elFinder's MySQL volume driver (elFinderVolumeMySQL) allows authenticated SQL injection through a crafted file hash passed via the target parameter. The issue is caused by two behaviors working together: 1. File hashes are decoded without validating that the decoded value is a valid MySQL object identifier. 2. The decoded value is then used in MySQL driver queries, including cacheDir(), joinPath(), stat(), and fopen(). Because the MySQL storage schema uses…
Recommended action: Upgrade to 2.1.68 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Severity High bg can be injected into shell command construction, leading to possible RCE in affected configurations. Summary elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This issue affects configurations where: - the resize command is enabled, - image processing uses the ImageMagick CLI backend, and - the vulnerable code paths are reachable. Impact An attacker may execute arbitrary OS commands with the privileges of the web server process. Impact depends on server configuration, enabled commands, backend image library selection, and surrounding deployment controls.…
Recommended action: Upgrade to 2.1.67 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Path Traversal vulnerability in PHP LocalVolumeDriver connector. This vulnerability can be exploited by allowing untrusted users to write to the local file system. This issue was caused by incomplete validity checking of the supplied request parameters. That problem has been fixed in elFinder Version 2.1.62. Patches This vulnerability has been fixed in elFinder 2.1.62. Installation managers should update to the latest version as soon as possible. Workarounds If you cannot update for some reason, you must stop using it or prohibit writing to untrusted users.
Recommended action: Upgrade to 2.1.62 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
Recommended action: Upgrade to 2.1.48 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue exists because of an incomplete fix for CVE-2018-9109.
Recommended action: Upgrade to 2.1.37 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.
Recommended action: Upgrade to 2.1.36 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safemode or openbasedir is not set.
Recommended action: Upgrade to 2.1.45 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.49 could allow a malicious user to access the content of internal network resources. This occurs in getremotecontents() in php/elFinder.class.php.
Recommended action: Upgrade to 2.1.49 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.
Recommended action: Upgrade to 2.1.61 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.
Recommended action: Upgrade to 2.1.60 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
Recommended action: Upgrade to 2.1.61 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact We recently fixed several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with the minimal configuration. Patches The issues were addressed in our last release, 2.1.59. Workarounds If you can't update to 2.1.59, make sure your connector is not exposed without authentication. Reference Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time. For more information If you have any questions or comments about this advisory, you can contact: - The original reporters, by sending an email to vulnerability.research@sonarsource.com; - The maintainers, by opening an issue on this repository.
Recommended action: Upgrade to 2.1.59 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Before elFinder 2.1.58, the upload filter did not disallow the upload of .phar files. As several Linux distributions are now shipping Apache configured in a way it will process these files as PHP scripts, attackers could gain arbitrary code execution on the server hosting the PHP connector (even in minimal configuration). Patches The issue has been addressed with https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1, associating .phar files to the right MIME type. Unless explicitly allowed in the configuration, such files cannot be uploaded anymore. This patch is part of the last release of elFinder, 2.1.58. Workarounds If you can't update to 2.1.58, make sure your connector is not exposed without authentication. Important tips Server-side scripts can often be created as text files. Currently, elFinder has an appropriate MIME type set for file extensions that are generally runnable on a web server. However, the server has various settings. In…
Recommended action: Upgrade to 2.1.58 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.