This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: snyk
Published: 2021-09-01T14:30:12.041928Z
Updated: 2024-09-16T22:24:58.738Z
Reserved: 2021-01-08T00:00:00
Link: CVE-2021-23428
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2021-09-01T15:15:08.520
Modified: 2022-06-28T14:11:45.273
Link: CVE-2021-23428
Redhat
No data.