Read the docs
TI-2026-29856 Aliases CVE-2026-41247GHSA-8q4h-8crm-5cvc

elFinder: Command injection in resize background color parameter when using ImageMagick CLI

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01569 75th percentileScored 2026-11-07
Fix Fixed elFinder (Studio-42): 2.1.67studio-42/elfinder (Packagist): 2.1.67

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Studio-42elFinderbefore 2.1.672.1.67Patch availableCNA
—studio-42/elfinder (Packagist)before 2.1.672.1.67Patch availableGHSA-8q4h-8crm-5cvc
  • elFinder VendorStudio-42 Affected before 2.1.67 Fixed in 2.1.67 Patch available CNA
  • studio-42/elfinder (Packagist) Vendor— Affected before 2.1.67 Fixed in 2.1.67 Patch available GHSA-8q4h-8crm-5cvc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*before 2.1.67VulnerableStd42
  • cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:* Versions before 2.1.67 Vulnerable ·Std42

Remediation

  • Fix · CNA elFinder (Studio-42) Fixed in 2.1.67
  • Fix · GHSA-8q4h-8crm-5cvc studio-42/elfinder (Packagist) Fixed in 2.1.67 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41247
  2. 2026-10-03 Alias added: GHSA-8q4h-8crm-5cvc

References

Advisory 2

Other 1

  • TI-2026-56500 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback CVSS 3.1HIGH 8.6
  • TI-2026-56501 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections CVSS 3.1MEDIUM 5.4
  • TI-2026-32450 elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL) CVSS 3.1HIGH 8.8
  • TI-2026-56502 elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE) CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences