CVE-2021-23427

Arbitrary File Write via Archive Extraction (Zip Slip)

High · published September 1, 2021

CVSS v3.1
8.6
EPSS
1%
Percentile
72.8
In the wild
Unconfirmed
What it is

This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:F/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.01431 · 72.8th percentile
Published
2021-09-01T14:30Z
EPSS history
Timeline
  • 01 SEP 14:30Z
    Arbitrary File Write via Archive Extraction (Zip Slip)
    cvelistv5