Which versions of elFinder are affected by EUVD-2026-25281?

elFinder file manager versions prior to 2.1.67 contain a command injection vulnerability that allows attackers to execute arbitrary operating system commands on the hosting server through the file…. A patch is available.

How to fix or mitigate EUVD-2026-25281?

Within 24 hours, conduct an inventory of all elFinder deployments across your infrastructure and document current versions, prioritizing systems with ImageMagick CLI backend configuration. Within 7 days, validate elFinder 2.1.67 in a staging environment that mirrors your production setup to confirm application compatibility and proper ImageMagick integration. Within 30 days, deploy version 2.1.67 to all production, development, and testing instances, retiring any pre-2.1.67 versions from service.

elFinder EUVD-2026-25281

Q: What is the CVSS score of EUVD-2026-25281?

EUVD-2026-25281 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-41247 HIGH

OS Command Injection (CWE-78)

2026-04-23 security-advisories@github.com

GHSA-8q4h-8crm-5cvc

Command Injection Elfinder Std42

8.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

AC:H because the non-default ImageMagick CLI backend must be configured; PR:L since invoking the resize command typically needs file-manager access; full C/I/A impact from command execution as the web server user.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:30 vuln.today

Analysis Generated

Jul 24, 2026 - 04:30 vuln.today

Patch released

Apr 28, 2026 - 18:57 nvd

Patch available

Apr 23, 2026 - 21:01 EUVD

EUVD ID Assigned

Apr 23, 2026 - 19:27 euvd

EUVD-2026-25281

CVE Published

Apr 23, 2026 - 19:17 nvd

HIGH 8.9

DescriptionGitHub Advisory

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.

AnalysisAI

Command injection in elFinder before 2.1.67 lets attackers reach OS command execution as the web server user through the resize command's bg (background color) parameter. When the file manager is configured with the ImageMagick CLI backend, the user-supplied bg value is interpolated into shell command strings without sufficient escaping, allowing shell metacharacter injection. Fixed in 2.1.67; no public exploit is identified at time of analysis, though the CVSS 4.0 threat metric E:P indicates proof-of-concept maturity, EPSS is low (0.44%), and it is not in CISA KEV.

Technical ContextAI

elFinder is a widely embedded open-source web file manager written in JavaScript (jQuery UI front end) with a PHP backend (composer package studio-42/elfinder). The flaw is a classic CWE-78 OS Command Injection: elFinder can perform image resize/rotate operations through several backend drivers, and when the ImageMagick command-line interface (the convert/mogrify CLI, as opposed to the PHP Imagick or GD extensions) is selected, the resize handler builds a shell command string. The bg parameter, meant to specify a background fill color, is concatenated into that command without allowlist validation or shell escaping, so characters like ;, |, $(), and backticks break out of the intended argument context. The CPE cpe:2.3:a:std42:elfinder identifies the affected product across all versions prior to the fix.

RemediationAI

Vendor-released patch: 2.1.67 - upgrade the studio-42/elfinder package to 2.1.67 or later, which validates bg against a strict allowlist of supported color formats and safely escapes the value before CLI command construction (see GHSA-8q4h-8crm-5cvc). If you cannot upgrade immediately, apply one or more compensating controls from the advisory: disable the resize command if it is not required (removes the vulnerable entry point but disables in-app image resizing/rotating for users); switch image processing away from the ImageMagick CLI backend to the PHP Imagick extension or GD (closes the shell-string code path but may change supported formats/quality); and restrict elFinder access to trusted, authenticated users only (reduces exposure but does not fix the underlying injection). Upgrading is strongly recommended over workarounds. Advisory URLs: https://github.com/Studio-42/elFinder/security/advisories/GHSA-8q4h-8crm-5cvc and https://vuldb.com/vuln/359197.