CVE-2024-38909

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-38909
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38909.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-38909
Aliases
Published
2024-07-30T00:00:00Z
Modified
2026-07-15T01:48:59.139332409Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38909.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/studio-42/elfinder

Affected ranges

Type
GIT
Repo
https://github.com/studio-42/elfinder
Events
Introduced
deaa6797df1c6f288238b47284c9b593174bfc0f
Last affected
deaa6797df1c6f288238b47284c9b593174bfc0f
Database specific 
{
    "cpe": "cpe:2.3:a:std42:elfinder:2.1.64:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.1.64"
        },
        {
            "last_affected": "2.1.64"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*
2.1.64

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38909.json"