CVE-2026-41247
Published: 23 April 2026
Description
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through…
more
image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.
Mitigating Controls (NIST 800-53 r5)AI
Requires identification, reporting, and correction of the specific command injection flaw in elFinder's resize command fixed in version 2.1.67.
Checks the validity of user-supplied bg parameter to block shell command injection into ImageMagick CLI processing.
Scans for and identifies vulnerable elFinder versions affected by CVE-2026-41247 to enable remediation.
Security SummaryAI
CVE-2026-41247 is a command injection vulnerability (CWE-78) affecting elFinder, an open-source web-based file manager written in JavaScript using jQuery UI, in versions prior to 2.1.67. The issue resides in the resize command, where the user-supplied "bg" (background color) parameter is accepted from input and passed through image resize/rotate processing. In configurations using the ImageMagick CLI backend, this parameter is incorporated into shell command strings without sufficient escaping, enabling potential injection.
An unauthenticated remote attacker (AV:N/AC:L/PR:N/UI:N) can exploit this vulnerability by invoking the resize command with a specially crafted "bg" value. Successful exploitation allows arbitrary command execution with the privileges of the web server process user, leading to high confidentiality, integrity, and availability impacts as reflected in the CVSS v3.1 base score of 9.8 (C:H/I:H/A:H/S:U).
The vulnerability is addressed in elFinder version 2.1.67. Additional details on the issue and mitigation are available in the GitHub security advisory at https://github.com/Studio-42/elFinder/security/advisories/GHSA-8q4h-8crm-5cvc.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-41247 is a command injection vulnerability in the public-facing web application elFinder, enabling unauthenticated remote attackers to achieve arbitrary command execution, directly facilitating T1190: Exploit Public-Facing Application.