CVE-2026-81891
HighCVSS 8.1Summary
In elFinder (a web file manager) before version 2.1.70, there is a vulnerability that allows bypassing file type restrictions during archive extraction. The checkExtractItems() function does not normalize the MIME type, so files with extensions .phtml, .phar, .php5, and .php3 can be extracted even if uploadDeny blocks text/x-php. An attacker with ZIP upload permission can place PHP files in a web-accessible directory and achieve remote code execution. The issue is fixed in version 2.1.70.
Risk Assessment
An attacker can achieve remote code execution on the server, potentially leading to full system compromise.
Recommendation
Update elFinder to version 2.1.70 or later which includes a fix for this vulnerability.
Other vulnerabilities in elFinder
See all- CVE-2026-81890Medium
elFinder before version 2.1.70 does not protect the netmount command against CSRF attacks because it is not included in the list of protected commands. In the default configuration, FTP network mounts are enabled, and an attacker can control parameters such as protocol, host, port, user, password, allowing persistent mounting of an attacker-chosen FTP server in the victim's session and sending credentials without a CSRF token.
- CVE-2026-81889High
In elFinder before version 2.1.70, there is a Server-Side Request Forgery (SSRF) vulnerability during URL uploads. When PHP cURL is unavailable, IP validation can be bypassed via DNS rebinding, allowing connections to internal addresses. Additionally, even when using cURL, there is a blind SSRF path. The issue is fixed in version 2.1.70.
- CVE-2024-38909Critical
Studio 42 elFinder version 2.1.64 is vulnerable to incorrect access control. Copying files with an unauthorized extension between server directories allows an attacker to expose secrets and perform remote code execution (RCE).
Original NVD description (English source)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.