What’s Vulnerable › Products

Studio-42 elFinder vulnerabilities

20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Studio-42 elFinder version is affected

Latest Studio-42 elFinder vulnerabilities

• CVE-2026-81891 — elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE) (CVSS 8.1)
• CVE-2026-81890 — elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections (CVSS 5.4)
• CVE-2026-81889 — elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback (CVSS 8.6)
• CVE-2026-44521 — elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL) (CVSS 8.8)
• CVE-2026-41247 — elFinder: Command injection in resize background color parameter when using ImageMagick CLI (CVSS 9.8)
• CVE-2023-52045 — (CVSS 6.1)
• CVE-2023-52044 — (CVSS 9.8)
• CVE-2024-38909 — (CVSS 9.8)
• CVE-2023-35840 — (CVSS 6.5)
• CVE-2022-27115 — (CVSS 9.8)
• CVE-2021-43421 — (CVSS 9.8)
• CVE-2022-26960 — (CVSS 9.1)
• CVE-2021-45919 — (CVSS 5.4)
• CVE-2021-32682 — Multiple vulnerabilities leading to RCE (CVSS 9.8)
• CVE-2021-23394 — Remote Code Execution (RCE) (CVSS 9.8)
• CVE-2019-9194 — (CVSS 9.8)
• CVE-2019-6257 — (CVSS 7.7)
• CVE-2019-5884 — (CVSS 5.9)
• CVE-2018-9110 — (CVSS 9.1)
• CVE-2018-9109 — (CVSS 9.1)