What’s Vulnerable › Vulnerabilities

CVE-2021-23394: Remote Code Execution (RCE)

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 18.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-13 · updated 2026-06-17
• Weakness: CWE-434

Description

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.

Affected products

• Studio-42 elFinder: before 2.1.58 — fixed in 2.1.58

How to fix

Upgrade to a fixed version: Studio-42 elFinder 2.1.58. Check the vendor advisory for mitigations.

References

• https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/
• https://github.com/Studio-42/elFinder
• https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1
• https://github.com/Studio-42/elFinder/issues/3295
• https://snyk.io/vuln/SNYK-PHP-STUDIO42ELFINDER-1290554
• https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/
• https://github.com/Studio-42/elFinder
• https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1
• https://github.com/Studio-42/elFinder/issues/3295
• https://snyk.io/vuln/SNYK-PHP-STUDIO42ELFINDER-1290554

Get alerted when CVE-2021-23394 or the next vulnerability affects your stack