Sign in
Deutsch English Español Polski
Critical

elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE

  • Disclosed: 16.06.2021
  • Updated: 11.10.2026 10:22

Impact

We recently fixed several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with the minimal configuration.

Patches

The issues were addressed in our last release, 2.1.59.

Workarounds

If you can't update to 2.1.59, make sure your connector is not exposed without authentication.

Reference

Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time.

For more information

If you have any questions or comments about this advisory, you can contact: - The original reporters, by sending an email to vulnerability.research@sonarsource.com; - The maintainers, by opening an issue on this repository.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package studio-42/elfinder < 2.1.59 2.1.59

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-22, CWE-78, CWE-918
Platform
Composer
Package
studio-42/elfinder
Disclosed
16.06.2021
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-wph3-44rj-92pr - CC BY 4.0

Vulnerability history: studio-42/elfinder

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (18) in the archive
Total entries
18
First → latest
06.2021 09.2026
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 7
  • High 8
  • Medium 3

Disclosures per year

Severity:
  1. elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
    High · 8.1 CVE-2026-81891 < 2.1.70 2.1.70
  2. elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
    High · 8.6 CVE-2026-81889 < 2.1.70 2.1.70
  3. elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)
    High · 8.8 CVE-2026-44521 < 2.1.68 2.1.68
  4. elFinder: Command injection in resize background color parameter when using ImageMagick CLI
    High · 9.8 CVE-2026-41247 < 2.1.67 2.1.67
  5. Studio 42 elFinder vulnerable to Incorrect Access Control
    High · 9.8 CVE-2024-38909 <= 2.1.64 no fix
  6. elFinder vulnerable to path traversal in LocalVolumeDriver connector
    High · 7.5 CVE-2023-35840 < 2.1.62 2.1.62
  7. elFinder command injection vulnerability in the PHP connector
    Critical · 9.8 CVE-2019-9194 < 2.1.48 2.1.48
  8. Directory Traversal in Studio 42 elFinder
    Critical · 9.1 CVE-2018-9110 >= 2.1.12, < 2.1.37 2.1.37
  9. elFinder Path Traversal vulnerability
    Critical · 9.1 CVE-2018-9109 < 2.1.36 2.1.36
  10. elFinder Server Side Request Forgery (SSRF)
    High · 7.7 CVE-2019-6257 < 2.1.49 2.1.49
  11. RCE in Studio-42 elFinder on Windows before 2.1.61
    Critical · 9.8 CVE-2022-27115 < 2.1.61 2.1.61
  12. elFinder Unrestricted File Upload vulnerability
    Critical · 9.8 CVE-2021-43421 >= 2.0.4, < 2.1.60 2.1.60
  13. Path Traversal in Studio-42 elFinder through 2.1.60
    Critical · 9.1 CVE-2022-26960 < 2.1.61 2.1.61
  14. elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE this entry
    Critical · 9.8 CVE-2021-32682 < 2.1.59 2.1.59
  15. elFinder unsafe upload filtering leading to remote code execution
    High · 8.1 CVE-2021-23394 < 2.1.58 2.1.58

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.