How many CVEs have a located fix in Studio-42/elFinder?

14 published CVEs have a fix traced to functions in Studio-42/elFinder, touching 39 functions across 6 files.

Which function in Studio-42/elFinder has been patched by the most CVEs?

get_remote_contents in php/elFinder.class.php has been changed by 5 CVE fixes, from 2019 to 2026.

How large is a typical CVE fix in Studio-42/elFinder?

The median fix changes 25 lines. 50% of fixes change 20 lines or fewer, and 43% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

php

#412 of 500 repositories

Studio-42/elFinder

Name: Studio-42/elFinder: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 31, 2026

14

CVE fixes located

Published CVEs

39

Functions patched

Distinct function sites

6

Files patched

Distinct source files

2018–2026

Years covered

By CVE publication date

Overview

14 published CVEs have a fix traced to functions in Studio-42/elFinder, the earliest published in 2018. Those fixes changed 39 distinct functions across 6 files, in 175 patch hunks.

Among the 500 repositories tracked here, Studio-42/elFinder ranks #412 by the number of CVEs with a located fix.

Most patched functions

Functions in Studio-42/elFinder changed by the most CVE fixes.

Most patched files

Files in Studio-42/elFinder changed by the most CVE fixes.

1php/elFinder.class.php9 CVEs · 16 functions
2php/elFinderVolumeDriver.class.php6 CVEs · 11 functions
3php/elFinderVolumeLocalFileSystem.class.php5 CVEs · 5 functions
4php/elFinderVolumeSFTPphpseclib.class.php1 CVEs · 5 functions
5php/elFinderConnector.class.php1 CVEs · 1 functions
6php/plugins/WinRemoveTailDots/plugin.php1 CVEs · 1 functions

Fix size

How much code a CVE fix in Studio-42/elFinder changes, with backports counted once.

25

Median lines changed

Added plus removed, per CVE

50%

Fixes of 20 lines or fewer

Share of CVE fixes

43%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in Studio-42/elFinder, and the functions each fix changed.

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
CVE-2026-81891checkExtractItems curlHeader getRemoteContentDispositionFileName
High · CVSS 8.1
EPSS 0.9%2026-08-31
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
CVE-2026-81890elFinderConnector
Medium · CVSS 5.4
EPSS 0.2%2026-08-31
elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
CVE-2026-81889curlHeader getRemoteContentDispositionFileName upload
High · CVSS 8.6
EPSS 0.5%2026-08-31
elFinder vulnerable to path traversal in LocalVolumeDriver connector
CVE-2023-35840_joinPath
High · CVSS 7.5
EPSS 1.9%2023-06-19
RCE in Studio-42 elFinder on Windows before 2.1.61
CVE-2022-27115elFinderPluginWinRemoveTailDots __construct configure
Critical · CVSS 9.8
EPSS 28.6%2022-04-11
elFinder Unrestricted File Upload vulnerability
CVE-2021-43421__construct
Critical · CVSS 9.8
EPSS 42.8%2022-04-07
Path Traversal in Studio-42 elFinder through 2.1.60
CVE-2022-26960getFullPath _abspath
Critical · CVSS 9.1
EPSS 51.0%2022-03-21
elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE
CVE-2021-32682abort get_remote_contents curl_get_contents
Critical · CVSS 9.8
EPSS 69.9%2021-06-14
elFinder unsafe upload filtering leading to remote code execution
CVE-2021-23394elFinderVolumeDriver
Critical · CVSS 9.8
EPSS 18.9%2021-06-13
elFinder command injection vulnerability in the PHP connector
CVE-2019-9194imgRotate imageMagickConvertPrepare createTmb
Critical · CVSS 9.8
EPSS 96.7%2019-02-26
elFinder Server Side Request Forgery (SSRF)
CVE-2019-6257get_remote_contents fsock_get_contents
High · CVSS 7.7
EPSS 1.1%2019-01-14
Sensitive Data Exposure in elFinder
CVE-2019-5884upload get_remote_contents
Medium · CVSS 5.9
EPSS 1.3%2019-01-10

Get an alert for each new Studio-42/elFinder CVE, with the patched functions and AI-written analysis.

Monitor elFinder CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

AcademySoftwareFoundation/OpenImageIO14 CVEs ail-project/ail-framework14 CVEs android.googlesource.com/platform-external-libhevc14 CVEs apostrophecms/apostrophe14 CVEs assimp/assimp14 CVEs authzed/spicedb14 CVEs bigtreecms/BigTree-CMS14 CVEs canonical/lxd14 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in Studio-42/elFinder.

How many CVEs have a located fix in Studio-42/elFinder?: 14 published CVEs have a fix traced to functions in Studio-42/elFinder, touching 39 functions across 6 files.
Which function in Studio-42/elFinder has been patched by the most CVEs?: get_remote_contents in php/elFinder.class.php has been changed by 5 CVE fixes, from 2019 to 2026.
How large is a typical CVE fix in Studio-42/elFinder?: The median fix changes 25 lines. 50% of fixes change 20 lines or fewer, and 43% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track Studio-42/elFinder CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing