Elfinder
Monthly
Remote code execution in elFinder prior to 2.1.70 allows an authenticated user with ZIP upload permission to bypass the uploadDeny MIME-type block for PHP-executable extensions. The root cause is that checkExtractItems() calls mimetypeInternalDetect() without normalizing the result through mimeTypeNormalize(), so .phtml, .phar, .php5, and .php3 extensions are not recognized as text/x-php during extraction, letting allowPutMime() approve files that direct upload would reject. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact is full server-side code execution if the web server processes these extensions as PHP.
SSRF protection bypass in elFinder's URL upload feature allows remote attackers to reach internal HTTP services by exploiting a DNS rebinding race condition in `php/elFinder.class.php` prior to version 2.1.70. The server stores the internal service's HTTP response body as an uploaded file that is subsequently readable through the elFinder interface, making this a non-blind SSRF - a more impactful variant than typical SSRF. A public proof-of-concept is available via the GHSA advisory; no active exploitation has been confirmed in the CISA KEV at time of analysis.
Command injection in elFinder before 2.1.67 lets attackers reach OS command execution as the web server user through the resize command's bg (background color) parameter. When the file manager is configured with the ImageMagick CLI backend, the user-supplied bg value is interpolated into shell command strings without sufficient escaping, allowing shell metacharacter injection. Fixed in 2.1.67; no public exploit is identified at time of analysis, though the CVSS 4.0 threat metric E:P indicates proof-of-concept maturity, EPSS is low (0.44%), and it is not in CISA KEV.
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
CSRF protection is absent for the netmount command in elFinder prior to 2.1.70, allowing a cross-site request from an attacker-controlled page to mount an attacker-chosen FTP server into an authenticated victim's session without a valid X-elFinder-CSRF token. Because the default connector.minimal.php-dist configuration enables FTP mounts and passes fully attacker-controlled parameters - host, port, credentials, path - directly to elFinderVolumeFTP, this also creates a server-side request forgery primitive: the PHP process itself initiates a TCP connection to the attacker-specified host and port. A vendor-confirmed patch is available in version 2.1.70; no public exploit has been identified at time of analysis.
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Cross-site request forgery (CSRF) vulnerability in the elFinder file manager module 6.x-0.x before 6.x-0.8 and 7.x-0.x before 7.x-0.8 for Drupal allows remote attackers to hijack the authentication. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Remote code execution in elFinder prior to 2.1.70 allows an authenticated user with ZIP upload permission to bypass the uploadDeny MIME-type block for PHP-executable extensions. The root cause is that checkExtractItems() calls mimetypeInternalDetect() without normalizing the result through mimeTypeNormalize(), so .phtml, .phar, .php5, and .php3 extensions are not recognized as text/x-php during extraction, letting allowPutMime() approve files that direct upload would reject. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact is full server-side code execution if the web server processes these extensions as PHP.
SSRF protection bypass in elFinder's URL upload feature allows remote attackers to reach internal HTTP services by exploiting a DNS rebinding race condition in `php/elFinder.class.php` prior to version 2.1.70. The server stores the internal service's HTTP response body as an uploaded file that is subsequently readable through the elFinder interface, making this a non-blind SSRF - a more impactful variant than typical SSRF. A public proof-of-concept is available via the GHSA advisory; no active exploitation has been confirmed in the CISA KEV at time of analysis.
Command injection in elFinder before 2.1.67 lets attackers reach OS command execution as the web server user through the resize command's bg (background color) parameter. When the file manager is configured with the ImageMagick CLI backend, the user-supplied bg value is interpolated into shell command strings without sufficient escaping, allowing shell metacharacter injection. Fixed in 2.1.67; no public exploit is identified at time of analysis, though the CVSS 4.0 threat metric E:P indicates proof-of-concept maturity, EPSS is low (0.44%), and it is not in CISA KEV.
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
CSRF protection is absent for the netmount command in elFinder prior to 2.1.70, allowing a cross-site request from an attacker-controlled page to mount an attacker-chosen FTP server into an authenticated victim's session without a valid X-elFinder-CSRF token. Because the default connector.minimal.php-dist configuration enables FTP mounts and passes fully attacker-controlled parameters - host, port, credentials, path - directly to elFinderVolumeFTP, this also creates a server-side request forgery primitive: the PHP process itself initiates a TCP connection to the attacker-specified host and port. A vendor-confirmed patch is available in version 2.1.70; no public exploit has been identified at time of analysis.
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Cross-site request forgery (CSRF) vulnerability in the elFinder file manager module 6.x-0.x before 6.x-0.8 and 7.x-0.x before 7.x-0.8 for Drupal allows remote attackers to hijack the authentication. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.