CVE-2024-38909

—

CVSS 3.1

9.8 critical

EPSS

<1%p40

Published

Jul 30, 2024 (Jul 30, 2024)

Modified

Jul 9, 2026

Description

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.

Vendors: std42
Products: elfinder
Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.