CVE-2017-8085: Exponentcms Exponent CMS

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.

Affected products

• Exponentcms Exponent CMS: up to and including 2.4.0

Published 2017-04-24. Last modified 2026-06-17.