logo

Database

Insecure file upload In studio-42/elfinder

Description

elFinder Unrestricted File Upload vulnerability A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2021-434212. NVD-2021-434213. OSV-2021-434214. GCVE-2021-43421

References

1. https://github.com/Studio-42/elFinder/issues/34292. https://github.com/Studio-42/elFinder/commit/c08bcbfa722d758d01975799b7036951eb5d33cb3. https://twitter.com/infosec_90/status/14551802863549194254. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43421.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.