PatchTheCVEkcfinder vulnerabilities and fixes
Recent CVEs affecting kcfinder, with upgrade or downgrade steps. 1 tracked.
kcfinder has 1 tracked vulnerability, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2021-01-01. Highest priority: CVE-2018-25002 (score 49/100).
- CVE-2018-25002 HIGH 8.8 UPGRADE uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-C
FAQ
How do I fix kcfinder vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is kcfinder being exploited right now?
None of the tracked kcfinder CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which kcfinder CVE should I patch first?
CVE-2018-25002 currently ranks highest (49/100): uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-C.