Publish Advisories

GHSA-7q88-jxvp-9gp2 GHSA-7q88-jxvp-9gp2
2026-05-22 18:04:22 -07:00 · 2023-07-07 19:17:15 +00:00
parent e7441cc730
commit 9fb526c05f
2 changed files with 64 additions and 46 deletions
@@ -0,0 +1,64 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7q88-jxvp-9gp2",
+  "modified": "2023-07-07T19:15:57Z",
+  "published": "2022-03-22T00:00:41Z",
+  "aliases": [
+    "CVE-2022-26960"
+  ],
+  "summary": "Path Traversal in Studio-42 elFinder through 2.1.60",
+  "details": "`connector.minimal.php` in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "studio-42/elfinder"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.1.61"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 2.1.60"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26960"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-07-07T19:15:57Z",
+    "nvd_published_at": "2022-03-21T17:15:00Z"
+  }
+}
@@ -1,46 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-7q88-jxvp-9gp2",
-  "modified": "2022-03-29T00:01:26Z",
-  "published": "2022-03-22T00:00:41Z",
-  "aliases": [
-    "CVE-2022-26960"
-  ],
-  "details": "connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26960"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.synacktiv.com/publications.html"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-22"
-    ],
-    "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2022-03-21T17:15:00Z"
-  }
-}