xerteonlinetoolkits-rce

Xerte Online Toolkits = 3.15 Ejecución Remota de Código Las versiones 3.15 y anteriores de Xerte Online Toolkits sufren de 3 vulnerabilidades en el componente /editor/elfinder/php/connector.php, que pueden ser encadenadas por un atacante no autenticado para lograr Ejecución Remota de Código RCE...

wp-file-manager-0day

CVE-2020-25213 wp-file-manager 6.7 2020年8月20日 WordPress 插件 0day elFinder 漏洞是一个众所周知的漏洞，我的脚本只是将路径改为 "/wp-content/plugins/wp-file-manager/"。不要再要求我为脚本或其他东西提供修复。RTFM... 参考链接： https://www.exploit-db.com/exploits/46481 https://www.exploit-db.com/exploits/46539...

CVE-2023-35840

CVE-2023-35840 elFinder 2.1.62 - PHP LocalVolumeDriver 连接器中的路径遍历漏洞 描述 PHP LocalVolumeDriver 连接器中存在路径遍历漏洞。此漏洞可被利用，允许不受信任的用户向本地文件系统写入数据。 该漏洞存在于 target 参数中，该参数包含一个 base64 编码的路径。例如，路径 pentest 被编码为： root@kitploit: 1cGVudGVzdA== 如果忽略 l1（它看起来是一个常量前缀），其余部分可以解码为： root@kitploit: pentest 因此，我们可以将其修改为：...

elFinder < 2.1.58 - Remote Code Execution

studio-42/elfinder before 2.1.58 contains a remote code execution caused by execution of PHP code in a .phar file, letting attackers execute arbitrary PHP code if the server parses .phar files as PHP, exploit requires server to parse .phar files as PHP. id: CVE-2021-23394 info: name: elFinder...

Maian Cart <=3.8 - Remote Code Execution

Maian Cart 3.0 to 3.8 via the elFinder file manager plugin contains a remote code execution vulnerability. id: CVE-2021-32172 info: name: Maian Cart =3.8 to mitigate this vulnerability. reference: - https://dreyand.github.io/maian-cart-rce/ - https://github.com/DreyAnd/maian-cart-rce -...

Xerte Online Toolkits <= 3.15 - Remote Code Execution

Xerte Online Toolkits versions 3.15 and earlier expose the elFinder file manager connector at /editor/elfinder/php/connector.php without authentication CVE-2026-34413, because the access-control redirect for unauthenticated users does not call exit/die and execution continues server-side. This is...

CVE-2019-9194-elFinder-Command-Injection-PoC

CVE-2019-9194 — elFinder 命令注入 PoC elFinder = 2.1.47 中通过 PHP 连接器组件存在的命令注入漏洞。允许未经身份验证的远程攻击者以 Web 服务器用户的身份执行任意代码。 工作原理 上传一个带有恶意文件名的有效 JPEG 文件，文件名中包含 shell 命令。 通过请求图像旋转触发漏洞，该操作将文件名未经清理地传递给 exiftran。 注入的命令将 PHP webshell SecSignal.php 写入服务器。 连接到 webshell 并进入交互式 shell。 使用要求 Python 3 requests 库 pip insta...

Studio-42 elFinder <2.1.60 - Arbitrary File Upload

Studio-42 elFinder 2.0.4 to 2.1.59 is vulnerable to unauthenticated file upload via connector.minimal.php which could allow a remote user to upload arbitrary files and execute PHP code. id: CVE-2021-43421 info: name: Studio-42 elFinder 2.1.60 - Arbitrary File Upload author: akincibor severity:...

elFinder <= 2.1.47 - Command Injection

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. The vulnerability occurs when performing image operations on JPEG files, where the filename is passed to the exiftran utility without proper sanitization, allowing command injection. id: CVE-2019-9194 info: name:...

elFinder <=2.1.60 - Local File Inclusion

elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. id: CVE-2022-26960 info: name: elFind...

elFinder 2.1.58 - Remote Code Execution

elFinder 2.1.58 is impacted by multiple remote code execution vulnerabilities that could allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. id: CVE-2021-32682 info: name: elFinder 2.1.58 - Remote Code Executi...

CVE-2026-81891

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:35+00:00| published-proof-of-concept| https://github.com/Studio-42/elFinder/security/advisories/GHSA-gxmj-r5rf-ggwq 2026-09-04 00:05:19+00:00| seen| https://bsky.app/profile/opsmatters.com/post/3muno52zkqz23...

EUVD-2026-68800

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...

GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

EUVD-2026-68772

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections...

Python-CVE-2020-25213

Python-CVE-2020-25213 用于 WP File Manager 漏洞的 Python 交互式利用工具。WordPress 的 File Manager wp-file-manager 插件 6.9 版本之前允许远程攻击者上传并执行任意 PHP 代码，因为它将一个不安全的示例 elFinder 连接器文件重命名为 .php 扩展名。 该脚本使用 argparse、requests、re、sys、os、json 和 random Python 模块。 要通过 pip 安装这些模块，请在命令行中执行以下命令： root@kitploit: pip install -r...

CVE-2021-23394

elFinder CVE-2021-23394 复现环境搭建 本仓库包含一个使用 Docker 对 CVE-2021-23394 （elFinder 任意文件执行漏洞）的复现环境。它设置了四个环境，用于对比漏洞版本与修复版本在 Apache 和 Nginx 下的表现。 概述 本环境包含： 1. Apache 漏洞版本 （端口 8080）：elFinder 2.1.57 在 Apache 上运行 2. Apache 修复版本 （端口 8081）：elFinder 2.1.66 在 Apache 上运行 3. Nginx 漏洞版本 （端口 8082）：elFinder 2.1.57 在...

CVE-2026-81889

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-81891

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...