CVE-2018-9109

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Studio-42/elFinder/commit/157f471d7e48f190f74e66eb5bc73360b5352fd3Patch, Third Party Advisory
https://github.com/Studio-42/elFinder/releases/tag/2.1.36Release Notes, Third Party Advisory
https://github.com/Studio-42/elFinder/wiki/Advisory-about-vulnerability-of-CVE-2018-9109-and-CVE-2018-9110Mitigation, Third Party Advisory
https://github.com/Studio-42/elFinder/commit/157f471d7e48f190f74e66eb5bc73360b5352fd3Patch, Third Party Advisory
https://github.com/Studio-42/elFinder/releases/tag/2.1.36Release Notes, Third Party Advisory
https://github.com/Studio-42/elFinder/wiki/Advisory-about-vulnerability-of-CVE-2018-9109-and-CVE-2018-9110Mitigation, Third Party Advisory

Timeline

Published: Mar 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-91109.1Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a re CVE-2018-91115.4Cross Site Scripting (XSS) exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15 via the configuration of a user acco CVE-2018-91129.8A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Bui CVE-2018-91137.8Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code, related to code injection CVE-2018-91155.3Systematic SitaWare 6.4 SP2 does not validate input from other sources sufficiently. e.g., information utilizing the NVG interface. An attac CVE-2018-91169.1An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and CVE-2018-91175.3WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application d CVE-2018-91187.5exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a CVE-2018-91196.1An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit ca CVE-2018-91205.4In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post.CVE-2018-91215.4In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment.CVE-2018-91225.4In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI.