CVE-2023-52044 - Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension

Back Back to CVE browser

CRITICAL

Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension

Published Oct 31, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 0.79%

Description

Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.

Affected products

Vendor Std42 Product Elfinder Default
n/a
- Version
  2.1.62
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Std42

Elfinder

n/a

Version	Status	Constraints
2.1.62	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-56723
Advisory
https://github.com/Studio-42/elFinder/issues/3615
ExploitIssue TrackingThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-56723		Advisory
https://github.com/Studio-42/elFinder/issues/3615		ExploitIssue TrackingThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 31, 2024

Updated Nov 1, 2024

Reserved Dec 26, 2023

Link CVE-2023-52044

CISA Vulnrichment

Updated Nov 1, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2023-52044

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-52044

ENISA EUVD

Assigner mitre

Published Oct 31, 2024

Updated Nov 1, 2024

Exploited since n/a

Link EUVD-2023-56723

EUVD-2023-56723