{"id":"CVE-2022-27115","published":"2022-04-11T14:19:31Z","modified":"2024-08-03T05:18:39Z","title":"In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.28594,"percentile":0.98132,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/Studio-42/elFinder/issues/3458","tags":["x_refsource_MISC"]}],"priority":{"score":19.6,"factors":[{"name":"EPSS percentile","points":19.63}]},"affected":[{"ecosystem":"Packagist","package":"studio-42/elfinder","vulnerableRanges":["<2.1.61"],"patched":["2.1.61"],"from":["GHSA-6p96-vfrc-fv32"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1650","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-studio-42-elfinder-cve-2019-5884","parents":[{"from":"CVE-2021-32682","to":"CVE-2022-27115","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["php/elFinder.class.php","php/elFinderVolumeLocalFileSystem.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17","https://github.com/Studio-42/elFinder/commit/69be51eea5b484822a29ddd40f1b72845954ba60"],"basis":"shared function","functions":["__construct","configure"]}]}],"packageHistory":[{"cve":"CVE-2021-32682","published":"2021-06-14","fixed":"2.1.59","kev":false},{"cve":"CVE-2021-43421","published":"2022-04-07","fixed":"2.1.60","kev":false,"link":{"from":"CVE-2021-43421","to":"CVE-2022-27115","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:studio-42/elfinder","fromFixed":"2.1.60","toFixed":"2.1.61","daysApart":4},{"kind":"same-code","provenance":"machine","files":["php/elFinderVolumeLocalFileSystem.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/c08bcbfa722d758d01975799b7036951eb5d33cb","https://github.com/Studio-42/elFinder/commit/69be51eea5b484822a29ddd40f1b72845954ba60"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.35,"basis":"same package + description similarity"}]}},{"cve":"CVE-2022-26960","published":"2022-03-21","fixed":"2.1.61","kev":false},{"cve":"CVE-2022-27115","published":"2022-04-11","fixed":"2.1.61","kev":false},{"cve":"CVE-2023-35840","published":"2023-06-19","fixed":"2.1.62","kev":false,"link":{"from":"CVE-2022-27115","to":"CVE-2023-35840","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:studio-42/elfinder","fromFixed":"2.1.61","toFixed":"2.1.62","daysApart":434},{"kind":"same-code","provenance":"machine","files":["php/elFinderVolumeLocalFileSystem.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/69be51eea5b484822a29ddd40f1b72845954ba60","https://github.com/Studio-42/elFinder/commit/bb9aaa7b096a1b83f2f85657c43f12131ece2891"],"basis":"shared file"}]}},{"cve":"CVE-2026-41247","published":"2026-04-23","fixed":"2.1.67","kev":false},{"cve":"CVE-2026-44521","published":"2026-05-27","fixed":"2.1.68","kev":false}],"package":"Packagist:studio-42/elfinder"}}