Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS05cmpwLXI1OGotZnhncc0VkQ

Path traversal in elFinder.NetCore

This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal

Permalink: https://github.com/advisories/GHSA-9rjp-r58j-fxgq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05cmpwLXI1OGotZnhncc0VkQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: over 1 year ago


CVSS Score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Identifiers: GHSA-9rjp-r58j-fxgq, CVE-2021-23428
References: Repository: https://github.com/gordon-matt/elFinder.NetCore
Blast Radius: 1.0

Affected Packages

nuget:elFinder.NetCore
Dependent packages: 0
Dependent repositories: 0
Downloads: 50,550 total
Affected Version Ranges: <= 1.3.5
No known fixed version
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5