CVE-2026-41247

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Studio-42/elFinder/security/advisories/GHSA-8q4h-8crm-5cvc	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) elFinder es un gestor de archivos de código abierto para web, escrito en JavaScript usando jQuery UI. Antes de la versión 2.1.67, elFinder contiene una vulnerabilidad de inyección de comandos en el comando resize. El parámetro bg (color de fondo) es aceptado de la entrada del usuario y pasado a través del procesamiento de redimensionamiento/rotación de imagen. En configuraciones que usan el backend CLI de ImageMagick, este valor se incorpora en cadenas de comandos de shell sin suficiente escape. Un atacante capaz de invocar el comando resize con un valor bg manipulado puede lograr la ejecución arbitraria de comandos como el usuario del proceso del servidor web. Esta vulnerabilidad está corregida en la versión 2.1.67.

Information

Published : 2026-04-23 19:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-41247

Mitre link : CVE-2026-41247

CVE.ORG link : CVE-2026-41247

JSON object : View

Products Affected

std42

elfinder

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-41247", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41247", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-25T01:25:15.260707Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Studio-42", "product": "elFinder", "versions": [{"status": "affected", "version": "< 2.1.67"}]}]}], "published": "2026-04-23T19:17:29.850", "references": [{"url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8q4h-8crm-5cvc", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67."}, {"lang": "es", "value": "elFinder es un gestor de archivos de c\u00f3digo abierto para web, escrito en JavaScript usando jQuery UI. Antes de la versi\u00f3n 2.1.67, elFinder contiene una vulnerabilidad de inyecci\u00f3n de comandos en el comando resize. El par\u00e1metro bg (color de fondo) es aceptado de la entrada del usuario y pasado a trav\u00e9s del procesamiento de redimensionamiento/rotaci\u00f3n de imagen. En configuraciones que usan el backend CLI de ImageMagick, este valor se incorpora en cadenas de comandos de shell sin suficiente escape. Un atacante capaz de invocar el comando resize con un valor bg manipulado puede lograr la ejecuci\u00f3n arbitraria de comandos como el usuario del proceso del servidor web. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.1.67."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63FA76DA-7915-44D5-AB1B-606A4D1D5174", "versionEndExcluding": "2.1.67"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}