{"id":"CVE-2021-32682","published":"2021-06-14T16:45:11Z","modified":"2024-08-03T23:25:31Z","title":"Multiple vulnerabilities leading to RCE","vendor":"Studio-42","product":"elFinder","tier":"core","eol":null,"affectedVersions":[{"vendor":"Studio-42","product":"elFinder","versions":["= 2.1.58"]}],"description":{"text":"elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw affects Studio-42's elFinder, an open-source JavaScript and jQuery UI file manager, specifically its PHP connector component, which is where the vulnerabilities reside. An attacker reaching the elFinder PHP connector over the network without authentication can exploit path traversal, server-side request forgery, and OS command injection flaws to execute arbitrary code and commands on the hosting server, even with minimal configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:32Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.69934,"percentile":0.99371,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"},{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.html","tags":["x_refsource_MISC"]},{"url":"https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Packagist","package":"studio-42/elfinder","vulnerableRanges":["<2.1.59"],"patched":["2.1.59"],"from":["GHSA-wph3-44rj-92pr"],"provenance":"source"}],"advisories":[{"id":"GHSA-wph3-44rj-92pr","url":"https://github.com/advisories/GHSA-wph3-44rj-92pr","severity":"CRITICAL","ecosystem":"Packagist","package":"studio-42/elfinder","vulnerableRanges":["<2.1.59"],"patched":["2.1.59"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-1418","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1418","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"elFinder Archive Command Injection","module":"exploit/linux/http/elfinder_archive_cmd_injection","type":"exploit","disclosureDate":"2021-06-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/elfinder_archive_cmd_injection.rb"}],"nuclei":[{"id":"CVE-2021-32682","name":"elFinder 2.1.58 - Remote Code Execution","severity":"critical","path":"http/cves/2021/CVE-2021-32682.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32682.yaml"}],"first":{"date":"2021-06-13","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/elfinder_archive_cmd_injection.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.html"],"flow":[],"timeline":[{"date":"2021-06-13","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/elfinder_archive_cmd_injection.rb","provenance":"source"},{"date":"2021-06-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-32682","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":31.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9937"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-studio-42-elfinder-cve-2019-5884","parents":[{"from":"CVE-2021-23394","to":"CVE-2021-32682","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-wph3-44rj-92pr","via":"reference","url":"https://github.com/Studio-42/elFinder/security/advisories/GHSA-qm58-cvvm-c5qr"},{"kind":"version-step","provenance":"source","package":"Packagist:studio-42/elfinder","fromFixed":"2.1.58","toFixed":"2.1.59","daysApart":1},{"kind":"same-code","provenance":"machine","files":["php/elFinderVolumeDriver.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1","https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17"],"basis":"rarely changed file"}]},{"from":"CVE-2019-5884","to":"CVE-2021-32682","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["php/elFinder.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/f133163f2d754584de65d718b2fde96191557316","https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17"],"basis":"shared function","functions":["abort"]}]},{"from":"CVE-2019-9194","to":"CVE-2021-32682","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["php/elFinderVolumeDriver.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/374c88d7030eb92749267e17a4af21cc7520efa5","https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.37,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2021-32682","to":"CVE-2021-43421","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:studio-42/elfinder","fromFixed":"2.1.59","toFixed":"2.1.60","daysApart":297},{"kind":"same-code","provenance":"machine","files":["php/elFinderVolumeLocalFileSystem.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17","https://github.com/Studio-42/elFinder/commit/c08bcbfa722d758d01975799b7036951eb5d33cb"],"basis":"shared function","functions":["__construct"]},{"kind":"similar","provenance":"machine","score":0.41,"basis":"same package + description similarity"}]},{"from":"CVE-2021-32682","to":"CVE-2022-27115","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["php/elFinder.class.php","php/elFinderVolumeLocalFileSystem.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17","https://github.com/Studio-42/elFinder/commit/69be51eea5b484822a29ddd40f1b72845954ba60"],"basis":"shared function","functions":["__construct","configure"]}]}],"packageHistory":[{"cve":"CVE-2019-9194","published":"2019-02-26","fixed":"2.1.48","kev":false},{"cve":"CVE-2019-6257","published":"2019-01-14","fixed":"2.1.49","kev":false},{"cve":"CVE-2021-23394","published":"2021-06-13","fixed":"2.1.58","kev":false},{"cve":"CVE-2021-32682","published":"2021-06-14","fixed":"2.1.59","kev":false},{"cve":"CVE-2021-43421","published":"2022-04-07","fixed":"2.1.60","kev":false},{"cve":"CVE-2022-26960","published":"2022-03-21","fixed":"2.1.61","kev":false},{"cve":"CVE-2022-27115","published":"2022-04-11","fixed":"2.1.61","kev":false}],"package":"Packagist:studio-42/elfinder"}}