Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
studio-42/elfinder
master @ ec5f811
22
Fixes
16
CVEs
CRITICAL
Peak severity
22.2%
Coverage
Highlights
Path Traversal: 4 prior fixes. Scrutinize any change in this area.
php/elFinder.class.php: most-fixed (5 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Path traversal issues in file system connectors consistently allow attackers to bypass base directory restrictions. Windows-specific issues (such as trailing dot stripping) and insufficient path normalization logic have historically exposed internal filesystem operations to arbitrary deletions (via unlink) and reads.
Remote Code Execution: File upload features are highly susceptible to bypasses of the execution blocklist. Attackers repeatedly find unmapped executable extensions (e.g., .php8, .phar) or exploit platform-specific directory separators to write executable files directly into web-accessible folders.
Server-Side Request Forgery (SSRF): The URL upload handler and external API volume drivers (like OneDrive) retrieve remote data using cURL without consistently applying DNS pinning or proxy configurations, leaving internal network resources vulnerable to probing and exploitation.