Authenticated OS Command Injection in Multiple elFinder Plugins (CVE-2026-6382)

Vulnerability Overview Vulnerability Name: Multiple elFinder Plugins - Authenticated OS Command Injection Description: The plugins fail to properly escape parameters passed to shell commands during image processing, allowing authenticated users to perform OS command injection. This vulnerability requires the presence of the ImageMagick CLI, or the PHP or extensions, on the server. CVE ID: CVE-2026-6382 Classification: - Type: RCE (Remote Code Execution) - OWASP Top 10: A1: Injection - CWE: CWE-94 - CVSS: 9.1 (critical) Affected Range Affected Plugins: - fileorganizer: Fixed in version 1.1.9 - file-manager-advanced: Fixed in version 5.4.12 - filester: Fixed in version 2.1.1 - wp-file-manager: Fixed in version 8.0.4 Remediation Fixed Versions: - fileorganizer: Upgrade to version 1.1.9 or later - file-manager-advanced: Upgrade to version 5.4.12 or later - filester: Upgrade to version 2.1.1 or later - wp-file-manager: Upgrade to version 8.0.4 or later Timeline Public Disclosure Date: 2026-06-15 Added Date: 2026-06-15 Last Updated: 2026-06-15 Additional Information Original Researcher: mcdruidd Submitter: mcdruidd Verification Status: Yes WPVDB ID: a27770b7-a4cc-42fa-88c1-19adfe1593a8 References CVE: CVE-2026-6382 Related Vulnerabilities Image Hotspot by DevVN < 1.2.6 - Authenticated (Author+) PHP Object Injection GS Testimonial Slider < 3.3.0 - Unauthenticated Arbitrary Shortcode Execution QuadMenu < 2.0.7 - Unauthenticated RCE via compiler_save Email Log < 2.4.9 - Unauthenticated Hook Injection Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via "task_id" Parameter POC Code POC code will be disclosed on 2026-07-07, allowing users time to update. --- The above is a summary of the key information regarding the vulnerability from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

Authenticated OS Command Injection in Multiple elFinder Plugins (CVE-2026-6382)