CVE-2026-81891

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70

Description The checkExtractItems() function in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Due to the absence of .phtml, .phar, .php5, and .php3 extensions from mime.types, the staticMimeMap entries that map these extensions to text/x-php are not applied. Consequently, allowPutMime() permits the extraction of these files even when uploadDeny is configured to block text/x-php. An attacker with ZIP upload permissions can extract PHP-executable files into a web-accessible files/ directory, leading to remote code execution when the server executes those extensions.

Recommendations Update to version 2.1.70.