CVE-2026-81891
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.
Properties
- summary
- elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
- severity
- HIGH
- epss_score
- 0.00904
- cvss_severity
- HIGH
- cvss_score
- 8.1
- retrieved_at
- 2026-10-17T02:41:43+00:00
- ghsa_published
- 2026-09-02T14:37:54Z
- source_url
- https://github.com/advisories/GHSA-gxmj-r5rf-ggwq
- ghsa_updated
- 2026-09-02T20:21:32Z
- ghsa_id
- GHSA-gxmj-r5rf-ggwq
- score
- 8.1
- last_source
- FIRST EPSS
- cve_id
- CVE-2026-81891
- cvss_vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- signal_observed_at
- 2026-09-11T17:55:57+00:00
- is_ghsa_only
- false
- vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- published_at
- 2026-08-31T21:17:52.757
- last_modified
- 2026-09-09T21:09:13.080
- epss_percentile
- 0.59045
Related Entities (6)
DESCRIBED_BY (1)
ENRICHED_BY (1)
REPORTED_BY (1)
VULNERABLE_TO (1)
AFFECTS (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph