Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

elFinder 2.1.64 allows unauthorized file copying

CVE-2024-38909 · published 2 years ago
Summary

An attacker can copy files with unauthorized extensions between directories, potentially exposing sensitive information or allowing them to execute code on the server. This can happen when an attacker has access to a user account with limited permissions. To mitigate this, update to the latest version of elFinder.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
composer studio-42 elfinder <= 2.1.64
– std42 elfinder 2.1.64
cpe:2.3:a:std42:elfinder:2.1.64:*:*:*:*:*:*:*
Original advisory text
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform ...
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published30 Jul 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-3h9f-mm2x-4j58 · GHSA
CVE-2024-38909 · NVD
CVE-2024-38909 · MITRE
CVE-2024-38909 · OSV
Track software like this
Free during beta