Patchfirst
Patchfirst
CVE-2019-9194 Public exploit EPSS 96.7%

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Summary

elFinder, a web-based file manager, contains a command injection vulnerability in its PHP connector in versions before 2.1.48.

Heading is the official description · CVE.org
Breakdown
60.0 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 21 months after disclosure. Public exploit code (Metasploit) was available the same day.

  1. DisclosedPublic exploit codeMetasploitday 0
  2. First seen exploitedVulnCheck KEV evidence+21 mo

See the family tree

6 related vulnerabilities in the same code over 3 years. The latest fix listed for studio-42/elfinder is 2.1.59.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2019-5884php/elFinder.class.php in elFinder before 2.1.45 leaks…10 Jan 2019
  2. Next fix in the same packageLow

    Why these are linked:

    • Fixed one release later2.1.45 → 2.1.48 (studio-42/elfinder)
    This CVECVE-2019-9194elFinder before 2.1.48 has a command injection vulnerability in…26 Feb 2019
  3. relatedMedium

    Why these are linked:

    CVE-2021-23394Remote Code Execution (RCE)13 Jun 2021
  4. relatedHigh

    Why these are linked:

    CVE-2021-32682Multiple vulnerabilities leading to RCE14 Jun 2021
  5. relatedHigh

    Why these are linked:

    • Fixed one release later2.1.59 → 2.1.60 (studio-42/elfinder)
    • Same code patched: elFinderVolumeLocalFileSystem.class.php (machine-matched)Functions: __constructcommit a106c35commit c08bcbf
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2021-43421A File Upload vulnerability exists in Studio-42 elFinder 2.0.4…7 Apr 2022
  6. Next fix in the same packageHigh

    Why these are linked:

    • Fixed one release later2.1.60 → 2.1.61 (studio-42/elfinder)
    • Same code patched: elFinderVolumeLocalFileSystem.class.php (machine-matched)commit c08bcbfcommit 69be51e
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2022-27115In Studio-42 elFinder 2.1.60, there is a vulnerability that…11 Apr 2022

Fixes in studio-42/elfinderPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.1.36CVE-2018-910928 Mar 2018
  2. 2.1.37CVE-2018-911028 Mar 2018
  3. 2.1.45CVE-2019-588410 Jan 2019
  4. 2.1.48CVE-2019-919426 Feb 2019
  5. 2.1.49CVE-2019-625714 Jan 2019
  6. 2.1.58CVE-2021-2339413 Jun 2021
  7. 2.1.59CVE-2021-3268214 Jun 2021Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: studio-42/elfinder.

Packagiststudio-42/elfinderGHSA-4223-qj94-7x9p

Upgrade to 2.1.59 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2021-23394, CVE-2021-32682).

Set the version to 2.1.59 or later in your composer.json.

First fixed in 2.1.48 for CVE-2019-9194.

Affected versions

If you runUpgrade to
All versions before 2.1.482.1.59first fix for this CVE: 2.1.48

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

5 links, grouped by NVD tag

x_refsource_CONFIRM 3

github.com/Studio-42/elFinder/compare/6884c4f...0740028github.com/Studio-42/elFinder/releases/tag/2.1.48github.com/Studio-42/elFinder/blob/master/README.md

exploit 2

exploit-db.com/exploits/46539/exploit-db.com/exploits/46481/
↑ ↓ chooseEnter openEsc close