CVE-2022-27115: Unrestricted Upload of File with Dangerous Type

April 11, 2022 (updated April 15, 2022)

In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.

References

github.com/Studio-42/elFinder/issues/3458
nvd.nist.gov/vuln/detail/CVE-2022-27115

Code Behaviors & Features

Detect and mitigate CVE-2022-27115 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →