CVE-2021-23427: Arbitrary File Write via Archive Extraction (Zip Slip)
Published Sep 1, 2021
·Updated
This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation.
Affected Software
1 affected component
Elfinder.netcore Project Elfinder.netcore
Event History
Sep 1, 2021
CVE Published
via MITRE·02:30 PM
Data Sourced
via MITRE·02:30 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-23427?
CVE-2021-23427 has been assigned a high severity rating due to the risk of arbitrary extraction.
2
How do I fix CVE-2021-23427?
To fix CVE-2021-23427, update to the latest version of elFinder.NetCore where the vulnerability has been addressed.
3
What versions of elFinder.NetCore are affected by CVE-2021-23427?
All versions of elFinder.NetCore are affected by CVE-2021-23427.
4
What type of vulnerability is CVE-2021-23427?
CVE-2021-23427 is an arbitrary extraction vulnerability due to insufficient validation in the ExtractAsync function.
5
Is my data at risk if I use elFinder.NetCore with CVE-2021-23427?
Yes, using affected versions of elFinder.NetCore exposes your system to potential data compromise due to unauthorized extraction.