CVE-2026-81891

Received Received - Intake

Remote Code Execution in elFinder File Manager

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-81891

Affected Vendors & Products

Vendor	Product	Version / Range
elnfiner	elfinder	2.1.70

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability in elFinder before 2.1.70 allows an attacker with ZIP upload permission to bypass file type restrictions. The function checkExtractItems() fails to properly normalize MIME types, so certain PHP file extensions (.phtml, .phar, .php5, .php3) are not recognized as executable code. This lets attackers upload and extract PHP files into a web-accessible directory, leading to remote code execution when the server processes those files.

Detection Guidance

Check the version of elFinder installed on your system. If it is below 2.1.70, the vulnerability is present. Run commands like 'find / -name elFinderVolumeDriver.class.php' to locate the file and verify its version.

Impact Analysis

If you use elFinder versions before 2.1.70, an attacker could upload malicious PHP files via ZIP archives and execute arbitrary code on your server. This could lead to full system compromise, data theft, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to protect sensitive data due to this flaw.

Mitigation Strategies

Upgrade elFinder to version 2.1.70 or later immediately. If upgrading is not possible, restrict write permissions to the files directory and block uploads of PHP-related extensions (.phtml, .phar, .php5, .php3).

Hi! I’m here to help you understand CVE-2026-81891. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70