CVE Catalog
CVE-2023-35840
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk1.64%
73th percentile - higher than 73% of all known CVEs
Summary
In elFinder before version 2.1.62, there is a path traversal vulnerability in the _joinPath method in elFinderVolumeLocalFileSystem.class.php, which may lead to unauthorized access to the file system.
Risk Assessment
An attacker can exploit this vulnerability to gain access to files they should not have access to, potentially leading to the disclosure of sensitive data.
Recommendation
It is recommended to update elFinder to version 2.1.62 or later to mitigate this vulnerability.
Original NVD description (English source)
_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.