Sign in
Deutsch English Español Polski
Critical

elFinder Path Traversal vulnerability

  • Disclosed: 13.05.2022
  • Updated: 11.10.2026 10:22

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package studio-42/elfinder < 2.1.36 2.1.36

References

CVSS score 9.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE)
CWE-22
Platform
Composer
Package
studio-42/elfinder
Disclosed
13.05.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-45x3-mw7q-wf7f - CC BY 4.0

Vulnerability history: studio-42/elfinder

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (18) in the archive
Total entries
18
First → latest
06.2021 09.2026
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 7
  • High 8
  • Medium 3

Disclosures per year

Severity:
  1. elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
    High · 8.1 CVE-2026-81891 < 2.1.70 2.1.70
  2. elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
    High · 8.6 CVE-2026-81889 < 2.1.70 2.1.70
  3. elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)
    High · 8.8 CVE-2026-44521 < 2.1.68 2.1.68
  4. elFinder: Command injection in resize background color parameter when using ImageMagick CLI
    High · 9.8 CVE-2026-41247 < 2.1.67 2.1.67
  5. Studio 42 elFinder vulnerable to Incorrect Access Control
    High · 9.8 CVE-2024-38909 <= 2.1.64 no fix
  6. elFinder vulnerable to path traversal in LocalVolumeDriver connector
    High · 7.5 CVE-2023-35840 < 2.1.62 2.1.62
  7. elFinder command injection vulnerability in the PHP connector
    Critical · 9.8 CVE-2019-9194 < 2.1.48 2.1.48
  8. Directory Traversal in Studio 42 elFinder
    Critical · 9.1 CVE-2018-9110 >= 2.1.12, < 2.1.37 2.1.37
  9. elFinder Path Traversal vulnerability this entry
    Critical · 9.1 CVE-2018-9109 < 2.1.36 2.1.36
  10. elFinder Server Side Request Forgery (SSRF)
    High · 7.7 CVE-2019-6257 < 2.1.49 2.1.49
  11. RCE in Studio-42 elFinder on Windows before 2.1.61
    Critical · 9.8 CVE-2022-27115 < 2.1.61 2.1.61
  12. elFinder Unrestricted File Upload vulnerability
    Critical · 9.8 CVE-2021-43421 >= 2.0.4, < 2.1.60 2.1.60
  13. Path Traversal in Studio-42 elFinder through 2.1.60
    Critical · 9.1 CVE-2022-26960 < 2.1.61 2.1.61
  14. elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE
    Critical · 9.8 CVE-2021-32682 < 2.1.59 2.1.59
  15. elFinder unsafe upload filtering leading to remote code execution
    High · 8.1 CVE-2021-23394 < 2.1.58 2.1.58

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.