GHSA-9rjp-r58j-fxgq

Suggest an improvement
Source
https://github.com/advisories/GHSA-9rjp-r58j-fxgq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-9rjp-r58j-fxgq/GHSA-9rjp-r58j-fxgq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9rjp-r58j-fxgq
Aliases
  • CVE-2021-23428
Published
2021-09-02T22:05:26Z
Modified
2026-03-13T22:11:17.814091Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
Summary
Path traversal in elFinder.NetCore
Details

This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal

Database specific 
{
    "github_reviewed_at": "2021-09-02T18:03:47Z",
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-20",
        "CWE-22"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2021-09-01T15:15:00Z"
}
References

Affected packages

NuGet / elFinder.NetCore

Package

Name
elFinder.NetCore
View open source insights on deps.dev
Purl
pkg:nuget/elFinder.NetCore

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
1.3.5

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.2.1
1.2.2
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-9rjp-r58j-fxgq/GHSA-9rjp-r58j-fxgq.json"