CVE-2013-1972: Alexey Sukhotin Elfinder

Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in the elFinder file manager module 6.x-0.x before 6.x-0.8 and 7.x-0.x before 7.x-0.8 for Drupal allows remote attackers to hijack the authentication of unspecified victims to create, modify, or delete files via unknown vectors.

Affected products

• Alexey Sukhotin Elfinder: version 6.x-0.4-beta1 only; version 6.x-0.4-beta3 only; version 6.x-0.5-beta2 only; version 6.x-0.6 only; version 6.x-0.7 only; version 7.x-0.6 only; …

Published 2013-06-24. Last modified 2026-06-16.