PoC Index

CVE-2022-26960

CRITICAL 9.1EPSS 51.0%

connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.

CVSS v3.1
9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v3.1
9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v2.0
5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
EPSS
50.99% chance of exploitation in the next 30 days, 99th percentile
Nuclei
critical · CWE-22
Published
2022-03-21
Updated
2024-08-03

Nuclei templates (1)

References

Related