CRITICAL 9.8 NuGet
Imporoper path validation in elFinder.NetCore
GHSA-wmpm-fq7r-jq56 · CVE-2021-23427
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-23427
- PACKAGE https://github.com/gordon-matt/elFinder.NetCore
- WEB https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystemDriver.cs#L226
- WEB https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystemDriver.cs%23L226
- WEB https://snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1567778
Ready to move
Start Securing
Free, no credit card | First findings in minutes