Description
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a studio-42/elfinder
unspecified to < 2.1.58affected
References
- https://snyk.io/vuln/SNYK-PHP-STUDIO42ELFINDER-1290554 ↗
- https://github.com/Studio-42/elFinder ↗
- https://github.com/Studio-42/elFinder/issues/3295 ↗
- https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1 ↗
- https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/ ↗