CVE-2024-38909

https://notcve.org/view.php?id=CVE-2024-38909

30 Jul 2024 — Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc. • http://elfinder.com •