CVE-2022-26960

connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.

• CWE-22

• https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6dbPatch, Third Party Advisory
• https://www.synacktiv.com/publications.htmlProduct
• https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.htmlExploit, Technical Description, Third Party Advisory
• https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6dbPatch, Third Party Advisory
• https://www.synacktiv.com/publications.htmlProduct
• https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.htmlExploit, Technical Description, Third Party Advisory

Published

Mar 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26951Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS …6.1
• CVE-2022-26952Digi Passport Firmware through 1.5.1,1 is affected by a buff…7.5
• CVE-2022-26953Digi Passport Firmware through 1.5.1,1 is affected by a buff…7.5
• CVE-2022-26954Multiple open redirect vulnerabilities in NopCommerce 4.10 t…6.1
• CVE-2022-26959There are two full (read/write) Blind/Time-based SQL injecti…9.8
• CVE-2022-2696The Restaurant Menu – Food Ordering System – Table Reservati…6.5
• CVE-2022-26964Weak password derivation for export in Devolutions Remote De…7.5
• CVE-2022-26965In Pluck 4.7.16, an admin user can use the theme upload func…7.2
• CVE-2022-26966An issue was discovered in the Linux kernel before 5.16.12. …5.5
• CVE-2022-26967GPAC 2.0 allows a heap-based buffer overflow in gf_base64_en…7.8
• CVE-2022-26969In Directus before 9.7.0, the default settings of CORS_ORIGI…9.8
• CVE-2022-2697A vulnerability was found in SourceCodester Simple E-Learnin…7.5