GHSA-9rjp-r58j-fxgqHighCVSS 8.6
Path traversal in elFinder.NetCore
🔗 CVE IDs covered (1)
📋 Description
This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal
🎯 Affected products1
- nuget/elFinder.NetCore:<= 1.3.5
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2021-23428
- https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystemDriver.cs#L387
- https://snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1313838
- https://github.com/gordon-matt/elFinder.NetCore
- https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystemDriver.cs%23L387
- https://github.com/advisories/GHSA-9rjp-r58j-fxgq