CVE-2026-6382critical

CVE-2026-6382: critical vulnerability in FileOrganizer

Multiple elFinder Plugins - Authenticated OS Command Injection

Published

Follow this CVE+ Monitor File Manager+ Monitor File Manager Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.1epss 1.4%
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
Unknown · Advanced File ManagerUnknown · File ManagerUnknown · File Manager ProUnknown · FileOrganizer
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — FileOrganizer

In the same product, most dangerous first.

CVE-2023-4827HIGHFile Manager Pro < 1.8 - Remote Code Execution via CSRFEPSS 7.9%CVE-2026-17540HIGHBit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source MismatchEPSS 1.8%CVE-2023-4861HIGHFile Manager Pro < 1.8.1 - Admin+ Remote Code ExecutionEPSS 1.7%CVE-2026-11565HIGHAdvanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_uiEPSS 1.3%CVE-2021-24177—WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)EPSS 0.9%CVE-2023-5907MEDIUMFile Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path TraversalEPSS 0.9%