8.1
High
CVE-2021-23394 The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code…
Description
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| studio-42/elfinder 2.1 | earliest → < 2.1.58 | 2.1.58 |