CVE-2021-23415: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

August 9, 2021 (updated August 31, 2021)

This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.

References

github.com/advisories/GHSA-pjxv-w3qj-j8m3
github.com/mguinness/elFinder.AspNet/commit/675049b39284a9e84f0915c71d688da8ebc7d720
nvd.nist.gov/vuln/detail/CVE-2021-23415

Code Behaviors & Features

Detect and mitigate CVE-2021-23415 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →