CVE-2026-81891
1 advisory.
Packagist/Studio-42/elFinder CVE-2026-81891: high 8.1, EPSS 0.90%
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Action: Upgrade Studio-42/elFinder to 2.1.70 or later.
composer require Studio-42/elFinder:2.1.70Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.70 | - |
Fixed versions
| 2.1.70 |
Sources
- osv: GHSA-gxmj-r5rf-ggwq
- https://github.com/Studio-42/elFinder/security/advisories/GHSA-gxmj-r5rf-ggwq
- https://nvd.nist.gov/vuln/detail/CVE-2026-81891
- https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff
- https://github.com/Studio-42/elFinder/commit/dd73e702820c146a192969800ee674ecdb208365
- https://github.com/Studio-42/elFinder
- https://github.com/Studio-42/elFinder/releases/tag/2.1.70
CVE-2026-81891 · published · modified · JSON