{"id":"CVE-2022-26960","aliases":["EUVD-2022-1364","GHSA-7q88-jxvp-9gp2"],"status":"published","title":"Path Traversal in Studio-42 elFinder through 2.1.60","description":"connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.50993,"percentile":0.98938,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2022-03-21T16:52:38Z","modified":"2026-10-28T02:30:43Z","exploits":[{"source":"nuclei","id":"CVE-2022-26960","title":"elFinder \u003c=2.1.60 - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26960.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"studio-42/elfinder","fixed_in":["2.1.61"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"studio-42/elfinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.60"},{"fixed":"2.1.61"}]}]},{"source":"osv","ecosystem":"Packagist","package":"studio-42/elfinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.61"}]}],"versions":["2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.18","2.1.19","2.1.2","2.1.20","2.1.21","2.1.22","2.1.23","2.1.24","2.1.25","2.1.26","2.1.27","2.1.28","2.1.29","2.1.3","2.1.30","2.1.31","2.1.32","2.1.33","2.1.34","2.1.35","2.1.36","2.1.37","2.1.38","2.1.39","2.1.4","2.1.40","2.1.41","2.1.42","2.1.43","2.1.44","2.1.45","2.1.46","2.1.47","2.1.48","2.1.49","2.1.5","2.1.50","2.1.51","2.1.52","2.1.53","2.1.54","2.1.55","2.1.56","2.1.57","2.1.58","2.1.59","2.1.6","2.1.60","2.1.7","2.1.8","2.1.9"]}],"products":[{"vendor":"std42","product":"elfinder"}],"references":[{"url":"https://www.synacktiv.com/publications.html","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26960","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7q88-jxvp-9gp2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26960.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-26960","description":"connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.","status":"published","published":"2022-03-21T16:52:38Z","modified":"2024-08-03T05:18:38.39Z","updated_at":"2026-11-02T14:34:26.293612Z"}],"euvd":[{"id":"EUVD-2022-1364","description":"connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.","status":"published","published":"2022-03-21T16:52:38Z","modified":"2024-08-03T05:18:38Z","updated_at":"2026-11-03T03:25:44.099503Z"}],"ghsa":[{"id":"GHSA-7q88-jxvp-9gp2","title":"Path Traversal in Studio-42 elFinder through 2.1.60","description":"`connector.minimal.php` in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.","status":"published","published":"2022-03-22T00:00:41Z","modified":"2023-07-07T19:15:59Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:56.605555Z"}],"nvd":[{"id":"CVE-2022-26960","description":"connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.","status":"published","published":"2022-03-21T17:15:07.74Z","modified":"2026-06-17T04:36:13.747Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:14.24948Z"}],"osv":[{"id":"GHSA-7q88-jxvp-9gp2","title":"Path Traversal in Studio-42 elFinder through 2.1.60","description":"`connector.minimal.php` in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.","status":"published","published":"2022-03-22T00:00:41Z","modified":"2024-02-16T07:57:42.381711Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"CVE-2022-26960","description":"connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.","status":"published","published":"2022-03-21T16:52:38Z","modified":"2026-10-28T02:30:43.768098908Z","updated_at":"2026-11-02T15:44:24.758293Z"}]}}