CVE-2023-35840: elFinder vulnerable to path traversal in LocalVolumeDriver connector
joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.
Other sources
elFinder vulnerable to path traversal in LocalVolumeDriver connector
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/studio-42/elfinderto a version that resolves this vulnerability.Fixed in 2.1.62
Event History
Frequently Asked Questions
What is the severity of CVE-2023-35840?
CVE-2023-35840 has a high severity rating due to its potential for unauthorized file access through path traversal.
How do I fix CVE-2023-35840?
To fix CVE-2023-35840, upgrade to elFinder version 2.1.62 or later.
What systems are affected by CVE-2023-35840?
CVE-2023-35840 affects elFinder versions prior to 2.1.62 on systems using the PHP LocalVolumeDriver connector.
What exploit methods are associated with CVE-2023-35840?
CVE-2023-35840 can be exploited using path traversal techniques to access unauthorized file directories.
Is a patch available for CVE-2023-35840?
Yes, a patch has been included in elFinder version 2.1.62 to address CVE-2023-35840.