Detections
Analytics
SCA: security update for studio-42/elfinder (GHSA-45x3-mw7q-wf7f)
critical Tenable Self-Hosted Container Security Plugin ID 433704
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the
zipdl() function that can allow a remote attacker to download files accessible by the web server process
and delete files owned by the account running the web server process. (CVE-2018-9109)
See Also
Plugin Details
Severity: Critical
ID: 433704
Version: Revision 1.2
Type: Local
Family: SCA Checks
Published: 8/19/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.04
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2018-9109
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/13/2022
Vulnerability Publication Date: 3/28/2018
Reference Information
CVE: CVE-2018-9109
cwe: CWE-22