{"answers":{"affected":"2 open source packages ship an affected version, including studio-42/elfinder. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-32682 exists.","fix":"Upgrade studio-42/elfinder to 2.1.59 or later.","what":"CVE-2021-32682 is a critical command injection vulnerability in Studio-42 elFinder, published on 14 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-32682 and fix it if it is affected.\n\nWhat it is: CVE-2021-32682 is a critical command injection vulnerability in Studio-42 elFinder, published on 14 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-32682 exists.\n\nAffected packages and fixed versions:\n- studio-42/elfinder (Packagist): affected all versions; fixed in 2.1.59\n- studio-42/elfinder (Packagist): affected all versions; fixed in 2.1.59\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-32682/ (Markdown: https://insights.sbomify.com/CVE-2021-32682/index.md)","id":"CVE-2021-32682","markdown":"https://insights.sbomify.com/CVE-2021-32682/index.md","name":"CVE-2021-32682","record":{"aliases":["GHSA-wph3-44rj-92pr"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Web file manager","requires_auth":"none","summary":"Attackers can execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration.","user_interaction":"not_required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"elfinder","vendor":"std42"}],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"},{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":"2021-06-13","github_poc":0,"max_poc_stars":null,"metasploit":1,"nuclei":1,"refs":[{"date":"2021-06-13","kind":"metasploit","ref":"exploit/linux/http/elfinder_archive_cmd_injection","stars":null,"title":"elFinder Archive Command Injection"},{"date":null,"kind":"nuclei","ref":"http/cves/2021/CVE-2021-32682.yaml","stars":null,"title":"elFinder 2.1.58 - Remote Code Execution"}],"tier":"weaponised"},"has_fix":true,"headline":"Multiple vulnerabilities leading to RCE","id":"CVE-2021-32682","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"command_injection","year":"2021"},"n_packages":2,"n_references":4,"next":{"headline":"XSS through createObjectURL","id":"CVE-2021-32683"},"packages":[{"ecosystem":"Packagist","fixed":["2.1.59"],"introduced":["0"],"last_affected":[],"package":"studio-42/elfinder","purl":null,"source":"GHSA-wph3-44rj-92pr"},{"ecosystem":"Packagist","fixed":["2.1.59"],"introduced":["0"],"last_affected":[],"package":"studio-42/elfinder","purl":"pkg:composer/studio-42/elfinder","source":"GHSA-wph3-44rj-92pr"}],"prev":{"headline":"Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks","id":"CVE-2021-32681"},"products":["elFinder"],"published":"2021-06-14","related":[{"cvss_score":9.8,"headline":"File upload in n/a","id":"CVE-2023-52044","kev_date_added":null,"published":"2024-10-31"},{"cvss_score":9.8,"headline":"Studio 42 elFinder vulnerable to Incorrect Access Control","id":"CVE-2024-38909","kev_date_added":null,"published":"2024-07-30"},{"cvss_score":9.8,"headline":"RCE in Studio-42 elFinder on Windows before 2.1.61","id":"CVE-2022-27115","kev_date_added":null,"published":"2022-04-11"},{"cvss_score":9.8,"headline":"elFinder Unrestricted File Upload vulnerability","id":"CVE-2021-43421","kev_date_added":null,"published":"2022-04-07"},{"cvss_score":9.8,"headline":"elFinder command injection vulnerability in the PHP connector","id":"CVE-2019-9194","kev_date_added":null,"published":"2019-02-26"},{"cvss_score":9.1,"headline":"Path Traversal in Studio-42 elFinder through 2.1.60","id":"CVE-2022-26960","kev_date_added":null,"published":"2022-03-21"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"BSD-3-Clause","name":"Metasploit"},{"class":"attribution","licence":"MIT","name":"Nuclei templates"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-03","vendors":["Studio-42"]},"summary":"Attackers can execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration.","url":"https://insights.sbomify.com/CVE-2021-32682/"}