CVE-2026-81891highCWE-434

CVE-2026-81891: falha de alta gravidade em Studio-42 elFinder

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar elFinder+ Monitorar studio-42/elfinder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.9%
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Studio-42 · elFinder
CVEs relacionadas — Studio-42 elFinder

No mesmo produto, das mais perigosas para as menos.

CVE-2021-32682CRITICALMultiple vulnerabilities leading to RCEEPSS 69.9%CVE-2026-41247HIGHelFinder: Command injection in resize background color parameter when using ImageMagick CLIEPSS 1.6%CVE-2026-81889HIGHelFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallbackEPSS 0.5%CVE-2026-44521HIGHelFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL)EPSS 0.2%CVE-2026-81890MEDIUMelFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connectionsEPSS 0.2%