Vulnerabilities

TI-2026-56502 CVE-2026-81891 · GHSA-gxmj-r5rf-ggwq

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

LOW 39

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00904 Published 2026-08-31 Fixed in 2.1.70 CWE-434

TI-2026-56501 CVE-2026-81890 · GHSA-9hjf-w35w-6vx2

MEDIUM 58

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00177 Published 2026-08-31 Fixed in 2.1.70 CWE-352

TI-2026-56500 CVE-2026-81889 · GHSA-8x3q-jpjh-qh5c

HIGH 76

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0055 Published 2026-08-31 Fixed in 2.1.70 CWE-918

TI-2026-32450 CVE-2026-44521 · GHSA-c3gj-q88f-7hqj

MEDIUM 40

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00243 Published 2026-05-27 Fixed in 2.1.68 CWE-89