- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 18 · 2 critical, 5 high, 2 medium
- Registry
- Packagist
Advisories 18
- CVE-2026-81891High 8.1
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Affected: fixed in 2.1.70.
- CVE-2026-81890Medium 5.4
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
Affected: fixed in 2.1.70.
- CVE-2026-81889High 8.6
elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
Affected: fixed in 2.1.70.
- CVE-2026-44521High 8.8
elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL)
Affected: fixed in 2.1.68.
- CVE-2026-41247High 8.9
elFinder: Command injection in resize background color parameter when using ImageMagick CLI
Affected: fixed in 2.1.67.
- CVE-2024-38909Critical 9.8
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control.
Affected: through 2.1.64.
- CVE-2023-35840Medium 6.5
_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.
Affected: fixed in 2.1.62.
- CVE-2022-27115Unrated
In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.
Affected: fixed in 2.1.61.
- CVE-2021-43421Unrated
A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user…
Affected: from 2.0.4, fixed in 2.1.60.
- CVE-2022-26960Unrated
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal.
Affected: fixed in 2.1.61.
- CVE-2021-45919Unrated
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.
Affected: through 2.1.31.
- CVE-2021-32682Critical 9.8
Multiple vulnerabilities leading to RCE
Affected: fixed in 2.1.59.
- CVE-2021-23394High 8.1
Remote Code Execution (RCE)
Affected: fixed in 2.1.58.
- CVE-2019-9194Unrated
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
Affected: fixed in 2.1.48.
- CVE-2019-6257Unrated
A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of…
Affected: fixed in 2.1.49.
Show all 18 advisoriesShow fewer advisories
- CVE-2019-5884Unrated
php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not…
Affected: fixed in 2.1.45.
- CVE-2018-9110Unrated
Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a…
Affected: from 2.1.12, fixed in 2.1.37.
- CVE-2018-9109Unrated
Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a…
Affected: fixed in 2.1.36.