studio-42/elfinder vulnerabilities (Packagist)

17 vulnerabilities.

• studio-42/elfinder Packagist elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections CVE-2026-81890 Fix available 5.4 MediumAugust 31, 2026
• studio-42/elfinder Packagist elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback CVE-2026-81889 Fix available 8.6 HighAugust 31, 2026
• studio-42/elfinder Packagist elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL) CVE-2026-44521 Fix available 8.8 HighMay 11, 2026
• studio-42/elfinder Packagist elFinder: Command injection in resize background color parameter when using ImageMagick CLI CVE-2026-41247 Fix available 8.9 HighApril 17, 2026
• studio-42/elfinder Packagist Studio 42 elFinder vulnerable to Incorrect Access Control CVE-2024-38909 9.8 CriticalJuly 30, 2024
• studio-42/elfinder Packagist elFinder vulnerable to path traversal in LocalVolumeDriver connector CVE-2023-35840 Public exploitFix available 6.5 MediumJune 14, 2023
• studio-42/elfinder Packagist RCE in Studio-42 elFinder on Windows before 2.1.61 CVE-2022-27115 Fix available EPSS 28.6% 9.8 CriticalApril 11, 2022
• studio-42/elfinder Packagist elFinder Unrestricted File Upload vulnerability CVE-2021-43421 Fix available EPSS 42.8% 9.8 CriticalApril 7, 2022
• studio-42/elfinder Packagist Path Traversal in Studio-42 elFinder through 2.1.60 CVE-2022-26960 Fix available EPSS 51.0% 9.1 CriticalMarch 21, 2022
• studio-42/elfinder Packagist Studio 42 elFinder allows stored XSS CVE-2021-45919 5.4 MediumFebruary 8, 2022
• studio-42/elfinder Packagist Multiple vulnerabilities leading to RCE CVE-2021-32682 Public exploitFix available EPSS 69.9% 9.8 CriticalJune 14, 2021
• studio-42/elfinder Packagist Remote Code Execution (RCE) CVE-2021-23394 Public exploitFix available EPSS 18.9% 8.1 HighJune 13, 2021
• studio-42/elfinder Packagist elFinder command injection vulnerability in the PHP connector CVE-2019-9194 Public exploitFix available EPSS 96.7% 9.8 CriticalFebruary 26, 2019
• studio-42/elfinder Packagist elFinder Server Side Request Forgery (SSRF) CVE-2019-6257 Fix available 7.7 HighJanuary 14, 2019
• studio-42/elfinder Packagist Sensitive Data Exposure in elFinder CVE-2019-5884 Fix available 5.9 MediumJanuary 10, 2019
• studio-42/elfinder Packagist Directory Traversal in Studio 42 elFinder CVE-2018-9110 Fix available 9.1 CriticalMarch 28, 2018
• studio-42/elfinder Packagist elFinder Path Traversal vulnerability CVE-2018-9109 Fix available 9.1 CriticalMarch 28, 2018