HIGH 8.6 NuGet
Path traversal in elFinder.NetCore
GHSA-9rjp-r58j-fxgq · CVE-2021-23428
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-23428
- PACKAGE https://github.com/gordon-matt/elFinder.NetCore
- WEB https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystemDriver.cs#L387
- WEB https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystemDriver.cs%23L387
- WEB https://snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1313838
Ready to move
Start Securing
Free, no credit card | First findings in minutes