https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:26:04 +0000 https://cve.radiocsirt.org/vuln/bdu:2021-03302 bdu:2021-03302 https://cve.radiocsirt.org/vuln/bdu:2021-03302 https://cve.radiocsirt.org/vuln/cnvd-2021-53904 cnvd-2021-53904 https://cve.radiocsirt.org/vuln/cnvd-2021-53904 https://cve.radiocsirt.org/vuln/euvd-2026-174277 EUVD-2026-174277 https://cve.radiocsirt.org/vuln/euvd-2026-174277 https://cve.radiocsirt.org/vuln/fkie_cve-2021-23394 <p>The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.</p> <p>The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-23394 https://cve.radiocsirt.org/vuln/ghsa-qm58-cvvm-c5qr <p><strong>Affected:</strong> Packagist: studio-42/elfinder</p> <p>### Impact</p> <p>Before elFinder 2.1.58, the upload filter did not disallow the upload of `.phar` files. As several Linux distributions are now shipping Apache configured in a way it will process these files as PHP scripts, attackers could gain arbitrary code execution on the server hosting the PHP connector (even in minimal configuration).</p> <p>### Patches</p> <p>The issue has been addressed with https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1, associating `.phar` files to the right MIME type. Unless explicitly allowed in the configuration, such files cannot be uploaded anymore. This patch is part of the last release of elFinder, 2.1.58.</p> <p>### Workarounds</p> <p>If you can&#39;t update to 2.1.58, make sure your connector is not exposed without authentication.</p> <p>### Important tips</p> <p>Server-side scripts can often be created as text files. Currently, elFinder has an appropriate MIME type set for file extensions that are generally runnable on a web server.</p> <p>However, the server has various settings. In some cases, the executable file may be judged as &#34;text/plain&#34;. Therefore, elFinder installers should understand the extensions that can be executed on the web server where elFinder is installed, and check if there are any missing items in the elFinder settings.</p> <p>The elFinder PHP connector has an option &#34;additionalMimeMap&#34; that specifies the MIME type for each extension. See [#3295(comment)](https://github.com/Studio-42/elFinder/issues/3295#issuecomment-853042139) for mor…</p> <p><strong>Affected:</strong> Packagist: studio-42/elfinder</p> <p>### Impact</p> <p>Before elFinder 2.1.58, the upload filter did not disallow the upload of `.phar` files. As several Linux distributions are now shipping Apache configured in a way it will process these files as PHP scripts, attackers could gain arbitrary code execution on the server hosting the PHP connector (even in minimal configuration).</p> <p>### Patches</p> <p>The issue has been addressed with https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1, associating `.phar` files to the right MIME type. Unless explicitly allowed in the configuration, such files cannot be uploaded anymore. This patch is part of the last release of elFinder, 2.1.58.</p> <p>### Workarounds</p> <p>If you can&#39;t update to 2.1.58, make sure your connector is not exposed without authentication.</p> <p>### Important tips</p> <p>Server-side scripts can often be created as text files. Currently, elFinder has an appropriate MIME type set for file extensions that are generally runnable on a web server.</p> <p>However, the server has various settings. In some cases, the executable file may be judged as &#34;text/plain&#34;. Therefore, elFinder installers should understand the extensions that can be executed on the web server where elFinder is installed, and check if there are any missing items in the elFinder settings.</p> <p>The elFinder PHP connector has an option &#34;additionalMimeMap&#34; that specifies the MIME type for each extension. See [#3295(comment)](https://github.com/Studio-42/elFinder/issues/3295#issuecomment-853042139) for mor…</p> https://cve.radiocsirt.org/vuln/ghsa-qm58-cvvm-c5qr https://cve.radiocsirt.org/vuln/gsd-2021-23394 gsd-2021-23394 https://cve.radiocsirt.org/vuln/gsd-2021-23394