{"id":"CVE-2021-23394","published":"2021-06-13T11:05:11Z","modified":"2024-09-16T22:30:47Z","title":"Remote Code Execution (RCE)","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"studio-42/elfinder","versions":[">= unspecified, < 2.1.58"]}],"description":{"text":"The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.18935,"percentile":0.97291,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-09-19","exploitedFirstSeen":"2024-09-19","ransomware":false,"evidence":[{"url":"https://www.f5.com/labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024","date":"2024-09-19"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/botpoke-scanner-switches-ip","date":"2024-11-25"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/continued-scanning-for-cve-2023-1389","date":"2025-01-21"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2021-23394","date":"2026-01-19"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://snyk.io/vuln/SNYK-PHP-STUDIO42ELFINDER-1290554","tags":["x_refsource_MISC"]},{"url":"https://github.com/Studio-42/elFinder","tags":["x_refsource_MISC"]},{"url":"https://github.com/Studio-42/elFinder/issues/3295","tags":["x_refsource_MISC"]},{"url":"https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1","tags":["x_refsource_MISC"]},{"url":"https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Packagist","package":"studio-42/elfinder","vulnerableRanges":["<2.1.58"],"patched":["2.1.58"],"from":["GHSA-qm58-cvvm-c5qr"],"provenance":"source"}],"advisories":[{"id":"GHSA-qm58-cvvm-c5qr","url":"https://github.com/advisories/GHSA-qm58-cvvm-c5qr","severity":"HIGH","ecosystem":"Packagist","package":"studio-42/elfinder","vulnerableRanges":["<2.1.58"],"patched":["2.1.58"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-1383","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1383","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-11-30","earliestUrl":"https://github.com/0xnemian/CVE-2021-23394","repos":[{"name":"0xnemian/CVE-2021-23394","url":"https://github.com/0xnemian/CVE-2021-23394","stars":0,"created":"2025-11-30"}]},"nuclei":[{"id":"CVE-2021-23394","name":"elFinder < 2.1.58 - Remote Code Execution","severity":"high","path":"http/cves/2021/CVE-2021-23394.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-23394.yaml"}],"first":{"date":"2025-11-30","source":"PoC-in-GitHub","url":"https://github.com/0xnemian/CVE-2021-23394"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-06-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-23394","provenance":"source"},{"date":"2024-09-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.f5.com/labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024","provenance":"source"},{"date":"2025-11-30","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/0xnemian/CVE-2021-23394","provenance":"source"}],"speed":{"daysToPublicExploit":1631,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 770 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.46,"detail":"percentile 0.9729"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-studio-42-elfinder-cve-2019-5884","parents":[{"from":"CVE-2019-9194","to":"CVE-2021-23394","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["php/elFinderVolumeDriver.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/374c88d7030eb92749267e17a4af21cc7520efa5","https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2021-23394","to":"CVE-2021-32682","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-wph3-44rj-92pr","via":"reference","url":"https://github.com/Studio-42/elFinder/security/advisories/GHSA-qm58-cvvm-c5qr"},{"kind":"version-step","provenance":"source","package":"Packagist:studio-42/elfinder","fromFixed":"2.1.58","toFixed":"2.1.59","daysApart":1},{"kind":"same-code","provenance":"machine","files":["php/elFinderVolumeDriver.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1","https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2019-5884","published":"2019-01-10","fixed":"2.1.45","kev":false},{"cve":"CVE-2019-9194","published":"2019-02-26","fixed":"2.1.48","kev":false},{"cve":"CVE-2019-6257","published":"2019-01-14","fixed":"2.1.49","kev":false},{"cve":"CVE-2021-23394","published":"2021-06-13","fixed":"2.1.58","kev":false},{"cve":"CVE-2021-32682","published":"2021-06-14","fixed":"2.1.59","kev":false},{"cve":"CVE-2021-43421","published":"2022-04-07","fixed":"2.1.60","kev":false},{"cve":"CVE-2022-26960","published":"2022-03-21","fixed":"2.1.61","kev":false}],"package":"Packagist:studio-42/elfinder"}}