CVE-2022-26960 Path Traversal in Studio-42 elFinder through 2.1.60

What is CVE-2022-26960?

CVE-2022-26960 is a critical path traversal vulnerability in n/a, published on 21 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.

Weakness: CWE-22

Which versions are affected by CVE-2022-26960?

2 open source packages ship an affected version, including studio-42/elfinder. It affects 1 product.

Products include Std42 Elfinder.

How do I fix CVE-2022-26960?

Upgrade studio-42/elfinder to 2.1.61 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-26960 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-26960 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in n/a

• CVE-2023-52044 File upload in n/a Critical 9.8
• CVE-2024-38909 Studio 42 elFinder vulnerable to Incorrect Access Control Critical 9.8
• CVE-2022-27115 RCE in Studio-42 elFinder on Windows before 2.1.61 Critical 9.8
• CVE-2021-43421 elFinder Unrestricted File Upload vulnerability Critical 9.8
• CVE-2021-32682 Multiple vulnerabilities leading to RCE Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7q88-jxvp-9gp2.