elFinder 2.1.58 - Remote Code Execution

🗓️ 05 Jul 2026 03:01:21Reported by ProjectDiscoveryType

nuclei🔗 github.com👁 378 Views

elFinder 2.1.58 - Remote Code Execution CVE-2021-32682 critical vulnerability impact arbitrary code execution on the serve

Reporter	Title	Published	Views	Family All 25
0day.today	elFinder Archive Command Injection Exploit	15 Sep 202100:00	–	zdt
BDU FSTEC	The vulnerability of the elFinder file manager stems from the incorrect implementation of authentication mechanisms, allowing attackers to execute arbitrary code.	29 Jun 202100:00	–	bdu_fstec
Circl	CVE-2021-32682	14 Jun 202120:37	–	circl
CNNVD	elFinder 代码问题漏洞	14 Jun 202100:00	–	cnnvd
CNVD	elFinder code issue vulnerability	17 Jun 202100:00	–	cnvd
Check Point Advisories	ElFinder File Manager Command Injection (CVE-2021-32682)	30 Dec 202100:00	–	checkpoint_advisories
CVE	CVE-2021-32682	14 Jun 202116:45	–	cve
Cvelist	CVE-2021-32682 Multiple vulnerabilities leading to RCE	14 Jun 202116:45	–	cvelist
Github Security Blog	elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE	16 Jun 202117:04	–	github
Metasploit	elFinder Archive Command Injection	20 Sep 202117:41	–	metasploit

Source	Link
smaranchand	www.smaranchand.com.np/2022/01/organization-vendor-application-security/
blog	www.blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities
github	www.github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-32682
github	www.github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17

id: CVE-2021-32682

info:
  name: elFinder 2.1.58 - Remote Code Execution
  author: smaranchand
  severity: critical
  description: elFinder 2.1.58 is impacted by multiple remote code execution vulnerabilities that could allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: Update to elFinder 2.1.59 or later. As a workaround, ensure the connector is not exposed without authentication.
  reference:
    - https://smaranchand.com.np/2022/01/organization-vendor-application-security/
    - https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities
    - https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32682
    - https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-32682
    cwe-id: CWE-22
    epss-score: 0.69934
    epss-percentile: 0.99292
    cpe: cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*
  metadata:
    max-request: 9
    vendor: std42
    product: elfinder
    github: https://github.com/Studio-42/elFinder
  tags: cve2021,cve,elfinder,misconfig,rce,oss,std42,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/elfinder/elfinder-cke.html"
      - "{{BaseURL}}/assets/backend/elfinder/elfinder-cke.html"
      - "{{BaseURL}}/assets/elFinder-2.1.9/elfinder.html"
      - "{{BaseURL}}/assets/elFinder/elfinder.html"
      - "{{BaseURL}}/backend/elfinder/elfinder-cke.html"
      - "{{BaseURL}}/elfinder/elfinder-cke.html"
      - "{{BaseURL}}/uploads/assets/backend/elfinder/elfinder-cke.html"
      - "{{BaseURL}}/uploads/assets/backend/elfinder/elfinder.html"
      - "{{BaseURL}}/uploads/elfinder/elfinder-cke.html"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "elfinder"
          - "php/connector"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100fb4cd8fd725c37efc716dee09ad3c2ac36e704da50fe15cb3a89672cc71d2d4d022100f8d19d47b13919d695a149d2a777bfa7bdc90b9c0c023c1aabf530c7bfe308ce:922c64590222798bb761d5b6d8e72950

04 Feb 2026 07:00Current

8High risk

Vulners AI Score8

CVSS 27.5

CVSS 3.19.8

EPSS0.69934