elFinder CVE-2026-81891

Exploitation requires three concurrent conditions: (1) the attacker must hold ZIP upload permission within elFinder - this is a granted role, not anonymous access, making unauthenticated exploitation possible only if elFinder is deployed with open/public upload access; (2) the web server must be configured to execute at least one of .phtml, .phar, .php5, or .php3 as PHP - this is non-default in stock Apache/nginx but common in shared hosting environments and many CPanel/ISPConfig setups; (3) the elFinder extraction target directory must be web-accessible, which is the default files/ directory. What limits exploitation: deployments where all three conditions are not simultaneously true are not exploitable; if the web server treats these extensions as plaintext or denies access to files/, the webshell cannot be triggered even after extraction. The uploadDeny configuration blocking text/x-php must also be in place for the bypass to be meaningful - if uploadDeny is not configured at all, direct PHP upload may already be possible.

The provided CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) rates impact as critical but complexity as High, which aligns with the multi-condition nature of this bypass. However, the PR:N metric warrants scrutiny: the description explicitly states the attacker requires 'ZIP upload permission,' implying at minimum a granted role or low-privilege authentication - this analysis assesses PR:L as more accurate. AC:H is appropriate given two additional conditions beyond network access: the server must be configured to execute .phtml/.phar/.php3/.php5 as PHP (non-default but common in shared hosting), and the extraction target must be web-accessible. No EPSS data, CISA KEV listing, or public POC was provided, so exploitation probability cannot be quantified independently. The combination of a concrete file-upload bypass, a clear RCE path, and multiple affected extension aliases makes this a medium-to-high operational priority for any deployment where ZIP upload is granted to untrusted users. The AC:H requirement meaningfully reduces the exploitable attack surface compared to a straightforward unrestricted upload flaw.

An attacker with a low-privilege elFinder account (or any account granted ZIP upload rights) crafts a ZIP archive containing a PHP webshell named shell.phtml. They upload and extract the archive through the elFinder UI; because checkExtractItems() misidentifies .phtml as a non-PHP MIME type, the uploadDeny block for text/x-php is not triggered, and the file is written to the web-accessible files/ directory. The attacker then issues an HTTP GET to /files/shell.phtml, the PHP interpreter executes the file, and the attacker has an interactive remote shell on the server.