PT-2026-34727

CVE-2026-41247

Published

2026-04-17

Updated

2026-04-23

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.67

Description An issue exists in the resize command where the bg (background color) parameter is accepted from user input and passed through image resize or rotate processing. In configurations utilizing the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping, allowing an attacker to achieve arbitrary command execution as the web server process user.

Recommendations Update to version 2.1.67.

Exploitability

Exploit

Fix

Impacts

Researchers

Mcdruid

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers