[HIGH] elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

PKSA-71vn-d2sp-v1x4 CVE-2026-81891 GHSA-gxmj-r5rf-ggwq

Affected version: <2.1.70

Reported by:
GitHub

[MEDIUM] elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

PKSA-th2b-2jzf-hmp6 CVE-2026-81890 GHSA-9hjf-w35w-6vx2

Affected version: <2.1.70

Reported by:
GitHub

[HIGH] elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

PKSA-r7xr-47v5-58tx CVE-2026-81889 GHSA-8x3q-jpjh-qh5c

Affected version: <=2.1.69

Reported by:
GitHub

[HIGH] elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)

PKSA-42xd-jnjn-nrty CVE-2026-44521 GHSA-c3gj-q88f-7hqj

Affected version: <=2.1.67

Reported by:
GitHub

[HIGH] elFinder: Command injection in resize background color parameter when using ImageMagick CLI

PKSA-2p87-h1j5-yb5n CVE-2026-41247 GHSA-8q4h-8crm-5cvc

Affected version: <2.1.67

Reported by:
GitHub

[HIGH] Studio 42 elFinder vulnerable to Incorrect Access Control

PKSA-sbbq-p6tj-yvtg CVE-2024-38909 GHSA-3h9f-mm2x-4j58

Affected version: <=2.1.64

Reported by:
GitHub

[HIGH] elFinder vulnerable to path traversal in LocalVolumeDriver connector

PKSA-rhf7-t8yy-3p3g CVE-2023-35840 GHSA-wm5g-p99q-66g4

Affected version: <2.1.62

Reported by:
GitHub