CVE-2021-23428

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	elFinder.NetCore	< unspecified

References

https://github.com/gordon-matt/elFinder.NetCoreProduct, Third Party Advisory
https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystemDriver.cs%23L387Broken Link
https://snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1313838Third Party Advisory
https://github.com/gordon-matt/elFinder.NetCoreProduct, Third Party Advisory
https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystemDriver.cs%23L387Broken Link
https://snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1313838Third Party Advisory

Timeline

Published: Sep 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-234297.5All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled wit CVE-2021-23434.3Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that a CVE-2021-234307.5All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.CVE-2021-234318.8The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.CVE-2021-234329.8This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()CVE-2021-234339.8The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters CVE-2021-234348.6This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path comp CVE-2021-234356.1This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_t CVE-2021-234369.8This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided ke CVE-2021-234377.5The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.CVE-2021-234389.8This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condi CVE-2021-234396.1This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a u