CVE-2021-23415: Directory Traversal

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-07-28 · updated 2026-06-17
Weakness: CWE-22

Description

This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.

Affected products

elFinder.AspNet: before 1.1.1 — fixed in 1.1.1

How to fix

Upgrade to a fixed version: elFinder.AspNet 1.1.1. Check the vendor advisory for mitigations.

References

https://github.com/mguinness/elFinder.AspNet/commit/675049b39284a9e84f0915c71d688da8ebc7d720
https://snyk.io/vuln/SNYK-DOTNET-ELFINDERASPNET-1315153
https://github.com/mguinness/elFinder.AspNet/commit/675049b39284a9e84f0915c71d688da8ebc7d720
https://snyk.io/vuln/SNYK-DOTNET-ELFINDERASPNET-1315153

Get alerted when CVE-2021-23415 or the next vulnerability affects your stack