CVE-2021-23428

Directory Traversal

High · published September 1, 2021

CVSS v3.1
8.6
EPSS
2%
Percentile
76.6
In the wild
Unconfirmed
What it is

This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:F/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.01670 · 76.6th percentile
Published
2021-09-01T14:30Z
EPSS history
Timeline
  • 01 SEP 14:30Z
    Directory Traversal
    cvelistv5