{"id":"CVE-2019-5884","aliases":["EUVD-2022-4329","GHSA-jcgc-vxqg-85xx"],"status":"published","title":"Sensitive Data Exposure in elFinder","description":"php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01275,"percentile":0.70116,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2019-01-10T06:00:00Z","modified":"2026-10-20T10:52:44Z","fixes":[{"ecosystem":"Packagist","package":"studio-42/elfinder","fixed_in":["2.1.45"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"studio-42/elfinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.45"}]}]},{"source":"osv","ecosystem":"Packagist","package":"studio-42/elfinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.45"}]}],"versions":["2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.18","2.1.19","2.1.2","2.1.20","2.1.21","2.1.22","2.1.23","2.1.24","2.1.25","2.1.26","2.1.27","2.1.28","2.1.29","2.1.3","2.1.30","2.1.31","2.1.32","2.1.33","2.1.34","2.1.35","2.1.36","2.1.37","2.1.38","2.1.39","2.1.4","2.1.40","2.1.41","2.1.42","2.1.43","2.1.44","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9"]}],"products":[{"vendor":"std42","product":"elfinder"}],"references":[{"url":"https://github.com/Studio-42/elFinder/releases/tag/2.1.45","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/Studio-42/elFinder/commit/f133163f2d754584de65d718b2fde96191557316","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5884","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jcgc-vxqg-85xx"}],"sources":{"cve":[{"id":"CVE-2019-5884","description":"php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.","status":"published","published":"2019-01-10T06:00:00Z","modified":"2024-08-04T20:09:23.658Z","updated_at":"2026-11-02T14:20:18.411291Z"}],"euvd":[{"id":"EUVD-2022-4329","description":"php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.","status":"published","published":"2019-01-10T06:00:00Z","modified":"2024-08-04T20:09:23Z","updated_at":"2026-11-03T03:06:50.297232Z"}],"ghsa":[{"id":"GHSA-jcgc-vxqg-85xx","title":"Sensitive Data Exposure in elFinder","description":"`php/elFinder.class.php` in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and `safe_mode` or `open_basedir` is not set.","status":"published","published":"2022-05-13T01:06:16Z","modified":"2023-07-07T19:09:27Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:56.605555Z"}],"nvd":[{"id":"CVE-2019-5884","description":"php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.","status":"published","published":"2019-01-10T08:29:00.263Z","modified":"2026-06-17T02:38:22.913Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"CVE-2019-5884","description":"php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.","status":"published","published":"2019-01-10T08:29:00.263Z","modified":"2026-10-20T10:52:44.859497272Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"GHSA-jcgc-vxqg-85xx","title":"Sensitive Data Exposure in elFinder","description":"`php/elFinder.class.php` in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and `safe_mode` or `open_basedir` is not set.","status":"published","published":"2022-05-13T01:06:16Z","modified":"2024-02-16T08:23:11.697819Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}