CVE-2021-23427

PoC —

CVSS 3.1

9.8 critical

EPSS

1%p72

Published

Sep 1, 2021 (Sep 1, 2021)

Modified

Jun 17, 2026

Description

This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation.

Vendors: elfinder.netcore project
Products: elfinder.netcore
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news0 stories

No ingested article mentions this CVE yet.