{"id":"CVE-2018-9109","published":"2018-03-28T06:00:00Z","modified":"2024-08-05T07:17:51Z","title":"Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl()…","vendor":null,"product":null,"tier":"tail","description":{"text":"Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02944,"percentile":0.87105,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/Studio-42/elFinder/commit/157f471d7e48f190f74e66eb5bc73360b5352fd3","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Studio-42/elFinder/wiki/Advisory-about-vulnerability-of-CVE-2018-9109-and-CVE-2018-9110","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Studio-42/elFinder/releases/tag/2.1.36","tags":["x_refsource_CONFIRM"]}],"priority":{"score":17.4,"factors":[{"name":"EPSS percentile","points":17.42}]},"affected":[{"ecosystem":"Packagist","package":"studio-42/elfinder","vulnerableRanges":["<2.1.36"],"patched":["2.1.36"],"from":["GHSA-45x3-mw7q-wf7f"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2311","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-studio-42-elfinder-cve-2018-9109","children":[{"from":"CVE-2018-9109","to":"CVE-2018-9110","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2018-9109.","from":"CVE.org","in":"CVE-2018-9110"},{"kind":"version-step","provenance":"source","package":"Packagist:studio-42/elfinder","fromFixed":"2.1.36","toFixed":"2.1.37","daysApart":0},{"kind":"same-code","provenance":"machine","files":["php/elFinder.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/157f471d7e48f190f74e66eb5bc73360b5352fd3","https://github.com/Studio-42/elFinder/commit/e6351557b86cc10a7651253d2d2aff7f6b918f8e"],"basis":"shared function","functions":["zipdl"]},{"kind":"similar","provenance":"machine","score":0.95,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2018-9109","published":"2018-03-28","fixed":"2.1.36","kev":false},{"cve":"CVE-2018-9110","published":"2018-03-28","fixed":"2.1.37","kev":false},{"cve":"CVE-2019-5884","published":"2019-01-10","fixed":"2.1.45","kev":false},{"cve":"CVE-2019-9194","published":"2019-02-26","fixed":"2.1.48","kev":false}],"package":"Packagist:studio-42/elfinder"}}