{"id":"CVE-2022-26960","details":"connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.","aliases":["GHSA-7q88-jxvp-9gp2"],"modified":"2026-10-22T10:36:15.737034664Z","published":"2022-03-21T16:52:38Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26960.json"},"references":[{"type":"WEB","url":"https://www.synacktiv.com/publications.html"},{"type":"WEB","url":"https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26960.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26960"},{"type":"FIX","url":"https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/studio-42/elfinder","events":[{"introduced":"0"},{"fixed":"33bee2654615db62e9b722efb4fdd2a21844fbb2"},{"fixed":"3b758495538a448ac8830ee3559e7fb2c260c6db"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"2.1.61"}],"source":"CPE_RANGE"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"3b758495538a448ac8830ee3559e7fb2c260c6db"}]}]}}],"versions":["2.1.60","2.1.59","2.1.58","2.1.57","2.1.56","2.1.55","2.1.54","2.1.53","2.1.52","2.1.51","2.1.50","2.1.49","2.1.48","2.1.47","2.1.46","2.1.45","2.1.44","2.1.43","2.1.42","2.1.41","2.1.40","2.1.39","2.1.38","2.1.37","2.1.36","2.1.35","2.1.34","2.1.33","2.1.32","2.1.31","2.1.30","2.1.29","2.1.28","2.1.27","2.1.26","2.1.25","2.1.24","2.1.23","2.1.22","2.1.21","2.1.20","2.1.19","2.1.18","2.1.17","2.1.16","2.1.15","2.1.14","2.1.13","2.1.12","2.1.11","2.1.10","2.1.9","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0","2.0-beta","1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-26960.json"}}],"schema_version":"1.9.2"}