CVE-2026-81891
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In elFinder (a web file manager) before version 2.1.70, there is a vulnerability that allows bypassing file type restrictions during archive extraction. The checkExtractItems() function does not normalize the MIME type, so files with extensions .phtml, .phar, .php5, and .php3 can be extracted even if uploadDeny blocks text/x-php. An attacker with ZIP upload permission can place PHP files in a web-accessible directory and achieve remote code execution. The issue is fixed in version 2.1.70.
Risk Assessment
An attacker can achieve remote code execution on the server, potentially leading to full system compromise.
Recommendation
Update elFinder to version 2.1.70 or later which includes a fix for this vulnerability.
Other vulnerabilities in elFinder
See all- CVE-2024-38909Critical
Studio 42 elFinder version 2.1.64 is vulnerable to incorrect access control. Copying files with an unauthorized extension between server directories allows an attacker to expose secrets and perform remote code execution (RCE).
- CVE-2026-81890Medium
elFinder before version 2.1.70 does not protect the netmount command against CSRF attacks because it is not included in the list of protected commands. In the default configuration, FTP network mounts are enabled, and an attacker can control parameters such as protocol, host, port, user, password, allowing persistent mounting of an attacker-chosen FTP server in the victim's session and sending credentials without a CSRF token.
- CVE-2026-81889High
In elFinder before version 2.1.70, there is a Server-Side Request Forgery (SSRF) vulnerability during URL uploads. When PHP cURL is unavailable, IP validation can be bypassed via DNS rebinding, allowing connections to internal addresses. Additionally, even when using cURL, there is a blind SSRF path. The issue is fixed in version 2.1.70.
Original NVD description (English source)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS