Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Studio-42/elFinder

              master @ 6f1da22
            

Fixes

CVEs

CRITICAL

Peak severity

18.5%

Coverage

Highlights

Path Traversal: 6 prior fixes. Scrutinize any change in this area.

php/elFinder.class.php: most-fixed (12 issues). Treat as high-risk during review.

30 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Multiple path traversal fixes across different components indicate recurring weaknesses in filename and path handling, with Windows-specific bypasses leading to RCE.

Reflected XSS: Frequent XSS fixes from unescaped file names and user-controlled strings in UI components, indicating a systemic lack of output encoding.

Authorization Bypass: Multiple fixes for missing disabled-command and permission checks across client and server, showing that command gating is inconsistently applied.