Remote Code Execution Vulnerability in elFinder File Manager by Studio-42

CVE-2026-81891

What is CVE-2026-81891?

elFinder is an open-source file manager designed for web use, built with JavaScript and jQuery UI. In versions prior to 2.1.70, a vulnerability exists due to improper handling of file type checks during ZIP uploads. Specifically, the function checkExtractItems() fails to normalize MIME types correctly, allowing PHP-executable files to be uploaded and executed remotely. This flaw poses a significant security risk, as attackers can exploit this weakness to extract malicious PHP files into a web-accessible directory. If an attacker has ZIP upload permissions, they can achieve remote code execution whenever the server processes those files.

References