CVE Intelligence
Analysis AI-assisted

CVE-2026-41247: elFinder: command injection in resize bg parameter with ImageMagick CLI

elFinder versions before 2.1.67 contain a command injection flaw in the resize command when the ImageMagick CLI backend is used. The bg background color parameter is placed into shell command strings without sufficient escaping, according to the record. NVD assigns a critical CVSS base score of 9.8, and the record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

elFinder is an open-source web file manager written in JavaScript with jQuery UI. According to the record, versions before 2.1.67 have a command injection weakness in the resize command. The bg (background color) parameter is passed through image resize and rotate processing and, when the ImageMagick CLI backend is used, is incorporated into shell command strings without sufficient escaping.

Impact

  • The record states that an attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user.
  • The weakness is classified as CWE-78, OS Command Injection.
  • NVD reports a CVSS base score of 9.8 (critical) with high confidentiality, integrity and availability impact in the vector. GitHub's CNA record lists a score of 8.9 under a different CVSS version.

Affected products and versions

  • Std42 Elfinder: versions before 2.1.67.
  • Studio-42 elFinder: versions before 2.1.67.
  • The record states the vulnerability is fixed in 2.1.67.

Exploitation status

CISA KEV does not list this CVE, so the record does not show active exploitation or exploitation in the wild. The SSVC fields in the record list exploitation as none and automatable as no. The EPSS probability is 0.02653 with a percentile of 0.85556. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade elFinder to version 2.1.67 or later, which the record identifies as the fixed release.
  • The GitHub security advisory linked in the record is classified there as a mitigation reference. Review it for vendor guidance.
  • Until the upgrade is applied, consider whether the resize functionality is needed and restrict who can reach it, particularly on internet-facing deployments.
  • Review whether the ImageMagick CLI backend is in use and run the web server under a least-privilege account.

Detection guidance

  • Review web server and application logs for requests to the resize endpoint that contain unusual or unexpected background color values.
  • Monitor for unexpected child processes spawned by the web server user, which may indicate command execution.
  • Check for unexpected file changes or outbound connections originating from the web server after resize requests.

Limitations of the available information

  • The record does not identify the vulnerable code lines, the exact escaping flaw, or the patch diff.
  • It is unclear from the record whether backends other than ImageMagick CLI are affected.
  • The record does not include a proof of concept or exploitation timeline, and no exploitation is confirmed in the consulted sources.
  • The affected product names differ between the two entries, and the record does not explain the difference.

Frequently asked questions

Which versions of elFinder are affected by CVE-2026-41247?

According to the record, versions before 2.1.67 are affected, and 2.1.67 is the fixed version.

Is this vulnerability known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. The record's SSVC exploitation field is none.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.