Multiple vulnerabilities leading to RCE

published 2021-06-14 5 y ago modified 2026-07-08 4 mo ago also GHSA-wph3-44rj-92pr , EUVD-2021-1418

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 69.9%; EPSS 69.9% chance of exploitation in 30 days, percentile 99.3%
public exploits: 1; Metasploit, plus a Nuclei check

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.

Patch / fix

fixed in 2 links 1

packagist studio-42/elfinder 2.1.59
std42 elfinder 2.1.59

github.com/Studio-42/elFinder@a106c35 commit

Timeline

2021-06-13 First public exploit (Metasploit exploit/linux/http/elfinder_archive_cmd_injection)
2021-06-14 Published

Exploit prediction

69.93% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/http/elfinder_archive_cmd_injection elFinder Archive Command Injection metasploit exploit, excellent rank, 2021-06-13
Nuclei template elFinder 2.1.58 - Remote Code Execution nuclei detection template
packetstormsecurity.com http://packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.html referenced PoC, tagged "exploit" by a source, unverified
blog.sonarsource.com https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
packagist	studio-42/elfinder	<2.1.59	2.1.59

Affected products

Studio-42 elFinder

Classification

Weakness

CWE-918 Server-Side Request Forgery
CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

github.com /Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17
web, patch, third-party-advisory
packetstormsecurity.com /files/164173/elFinder-Archive-Command-Injection.html
web, exploit, third-party-advisory, vdb-entry
blog.sonarsource.com /elfinder-case-study-of-web-file-manager-vulnerabilities/
exploit, third-party-advisory
github.com /Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr
web, third-party-advisory
github.com /Studio-42/elFinder/security/advisories/GHSA-qm58-cvvm-c5qr
web
nvd.nist.gov /vuln/detail/CVE-2021-32682
advisory
blog.sonarsource.com /elfinder-case-study-of-web-file-manager-vulnerabilities
web
github.com /Studio-42/elFinder
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary