Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81891— elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Quick assessment

Affected
Studio-42 elFinder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述的中文翻译： elFinder 是一个开源的 Web 文件管理器，使用 JavaScript 和 jQuery UI 编写。在 2.1.70 版本之前， 中的 方法在调用 后，未将返回结果通过 进行规范化处理。由于 文件中缺少对 、 、 和 扩展名的定义， 中将这些扩展名映射为 的静态映射规则未能生效。同时， 在 已阻止 的情况下，仍允许文件提取操作。因此，拥有 ZIP 上传权限的攻击者可以将可执行的 PHP 文件（如上述扩展名）提取到 Web 可访问的 目录中。当服务器配置为执行这些扩展名时，即可

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81891

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Source: CVE Program / CVE List V5
Vulnerability Description
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Studio-42 elFinder < 2.1.70 -

II. Public POCs for CVE-2026-81891

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81891

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-81891 (2)

Vendor Advisories for CVE-2026-81891 (1)

Vendor Pages for CVE-2026-81891 (1)

Same Patch Batch · Studio-42 · 2026-08-31 · 3 CVEs total

CVE-2026-81889 8.6 HIGH elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
CVE-2026-81890 5.4 MEDIUM elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

IV. Related Vulnerabilities

Same product: elFinder
Same vendor: Studio-42
Same weakness: CWE-434

V. Comments for CVE-2026-81891

No comments yet

Leave a comment