Sign in
Deutsch English Español Polski
Critical

elFinder Unrestricted File Upload vulnerability

  • Disclosed: 08.04.2022
  • Updated: 11.10.2026 10:22

A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package studio-42/elfinder >= 2.0.4, < 2.1.60 2.1.60

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-434
Platform
Composer
Package
studio-42/elfinder
Disclosed
08.04.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-x4jx-hjwf-gc99 - CC BY 4.0

Vulnerability history: studio-42/elfinder

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (18) in the archive
Total entries
18
First → latest
06.2021 09.2026
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 7
  • High 8
  • Medium 3

Disclosures per year

Severity:
  1. elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
    High · 8.1 CVE-2026-81891 < 2.1.70 2.1.70
  2. elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
    High · 8.6 CVE-2026-81889 < 2.1.70 2.1.70
  3. elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)
    High · 8.8 CVE-2026-44521 < 2.1.68 2.1.68
  4. elFinder: Command injection in resize background color parameter when using ImageMagick CLI
    High · 9.8 CVE-2026-41247 < 2.1.67 2.1.67
  5. Studio 42 elFinder vulnerable to Incorrect Access Control
    High · 9.8 CVE-2024-38909 <= 2.1.64 no fix
  6. elFinder vulnerable to path traversal in LocalVolumeDriver connector
    High · 7.5 CVE-2023-35840 < 2.1.62 2.1.62
  7. elFinder command injection vulnerability in the PHP connector
    Critical · 9.8 CVE-2019-9194 < 2.1.48 2.1.48
  8. Directory Traversal in Studio 42 elFinder
    Critical · 9.1 CVE-2018-9110 >= 2.1.12, < 2.1.37 2.1.37
  9. elFinder Path Traversal vulnerability
    Critical · 9.1 CVE-2018-9109 < 2.1.36 2.1.36
  10. elFinder Server Side Request Forgery (SSRF)
    High · 7.7 CVE-2019-6257 < 2.1.49 2.1.49
  11. RCE in Studio-42 elFinder on Windows before 2.1.61
    Critical · 9.8 CVE-2022-27115 < 2.1.61 2.1.61
  12. elFinder Unrestricted File Upload vulnerability this entry
    Critical · 9.8 CVE-2021-43421 >= 2.0.4, < 2.1.60 2.1.60
  13. Path Traversal in Studio-42 elFinder through 2.1.60
    Critical · 9.1 CVE-2022-26960 < 2.1.61 2.1.61
  14. elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE
    Critical · 9.8 CVE-2021-32682 < 2.1.59 2.1.59
  15. elFinder unsafe upload filtering leading to remote code execution
    High · 8.1 CVE-2021-23394 < 2.1.58 2.1.58

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.