GHSA-wm5g-p99q-66g4

    Dashboard / Vulnerabilities / GHSA-wm5g-p99q-66g4

    GHSA-wm5g-p99q-66g4

    Published: 14 Jun 2023Last Modified: 8 Jul 2026

    Summary: elFinder vulnerable to path traversal in LocalVolumeDriver connector

    Details: ### Impact Path Traversal vulnerability in PHP LocalVolumeDriver connector. This vulnerability can be exploited by allowing untrusted users to write to the local file system. This issue was caused by incomplete validity checking of the supplied request parameters. That problem has been fixed in elFinder Version 2.1.62. ### Patches This vulnerability has been fixed in elFinder 2.1.62. Installation managers should update to the latest version as soon as possible. ### Workarounds If you cannot update for some reason, you must stop using it or prohibit writing to untrusted users.

    References: https://github.com/Studio-42/elFinder/security/advisories/GHSA-wm5g-p99q-66g4, https://github.com/Studio-42/elFinder/commit/bb9aaa7b096a1b83f2f85657c43f12131ece2891, https://github.com/Studio-42/elFinder

    Affected packages

    Package

    Name: studio-42/elfinder

    Purl: pkg:composer/studio-42/elfinder

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.1.62

    Affected versions

    2.0.3
    2.0.4
    2.0.5
    2.0.6
    2.0.7
    2.0.8
    2.0.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-wm5g-p99q-66g4 | CVE-DB