Cyber Posture

CVE-2026-41247

Critical

Published: 23 April 2026

Published
23 April 2026
Modified
28 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 36.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through…

more

image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires identification, reporting, and correction of the specific command injection flaw in elFinder's resize command fixed in version 2.1.67.

prevent

Checks the validity of user-supplied bg parameter to block shell command injection into ImageMagick CLI processing.

detect

Scans for and identifies vulnerable elFinder versions affected by CVE-2026-41247 to enable remediation.

Security SummaryAI

CVE-2026-41247 is a command injection vulnerability (CWE-78) affecting elFinder, an open-source web-based file manager written in JavaScript using jQuery UI, in versions prior to 2.1.67. The issue resides in the resize command, where the user-supplied "bg" (background color) parameter is accepted from input and passed through image resize/rotate processing. In configurations using the ImageMagick CLI backend, this parameter is incorporated into shell command strings without sufficient escaping, enabling potential injection.

An unauthenticated remote attacker (AV:N/AC:L/PR:N/UI:N) can exploit this vulnerability by invoking the resize command with a specially crafted "bg" value. Successful exploitation allows arbitrary command execution with the privileges of the web server process user, leading to high confidentiality, integrity, and availability impacts as reflected in the CVSS v3.1 base score of 9.8 (C:H/I:H/A:H/S:U).

The vulnerability is addressed in elFinder version 2.1.67. Additional details on the issue and mitigation are available in the GitHub security advisory at https://github.com/Studio-42/elFinder/security/advisories/GHSA-8q4h-8crm-5cvc.

Details

CWE(s)

Affected Products

std42
elfinder
≤ 2.1.67

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CVE-2026-41247 is a command injection vulnerability in the public-facing web application elFinder, enabling unauthenticated remote attackers to achieve arbitrary command execution, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References