CVE-2022-26960
Path Traversal in Studio-42 elFinder through 2.1.60
9.1
CRITICAL
CVSS 3.1
EPSS 84.2%
Description
`connector.minimal.php` in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
How to fix CVE-2022-26960
To remediate CVE-2022-26960, upgrade the affected package to a fixed version below.
- —upgrade to 2.1.61 or later
Is CVE-2022-26960 being exploited?
Likely — EPSS is 84.2%, placing CVE-2022-26960 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.
Affected packages (1)
- from 0, < 2.1.61
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |