CVE-2022-26960: STD42 Elfinder

Critical severity, CVSS 9.1. EPSS: 51% chance of exploitation in the next 30 days.

connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.

Affected products

• STD42 Elfinder: before 2.1.61 (fixed in 2.1.61)

Published 2022-03-21. Last modified 2026-06-17.