CVE-2023-35840

CVE-2023-35840 elFinder 2.1.62 - Vulnerabilidad de Path Traversal en el conector PHP LocalVolumeDriver Descripción Vulnerabilidad de Path Traversal en el conector PHP LocalVolumeDriver. Esta vulnerabilidad puede ser explotada al permitir que usuarios no confiables escriban en el sistema de archiv...

wp-file-manager-0day

CVE-2020-25213 wp-file-manager 6.7 20th Aug 2020 Wordpress Plugin 0day elFinder vulnerability is a well-know vulnerability, my script only changes path to "/wp-content/plugins/wp-file-manager/". Stop requesting fixes in script or something else for me. RTFM... References:...

xerteonlinetoolkits-rce

Xerte Online Toolkits = 3.15 Ejecución Remota de Código Las versiones 3.15 y anteriores de Xerte Online Toolkits sufren de 3 vulnerabilidades en el componente /editor/elfinder/php/connector.php, que pueden ser encadenadas por un atacante no autenticado para lograr Ejecución Remota de Código RCE...

Python-exploit-CVE-2020-25213

Descripción El plugin File Manager wp-file-manager anterior a la versión 6.9 para WordPress permite a atacantes remotos cargar y ejecutar código PHP arbitrario porque renombra un archivo de conector elFinder de ejemplo inseguro para que tenga la extensión .php. Esto, por ejemplo, permite a los...

Xerte Online Toolkits <= 3.15 - Remote Code Execution

Xerte Online Toolkits versions 3.15 and earlier expose the elFinder file manager connector at /editor/elfinder/php/connector.php without authentication CVE-2026-34413, because the access-control redirect for unauthenticated users does not call exit/die and execution continues server-side. This is...

Maian Cart <=3.8 - Remote Code Execution

Maian Cart 3.0 to 3.8 via the elFinder file manager plugin contains a remote code execution vulnerability. id: CVE-2021-32172 info: name: Maian Cart =3.8 to mitigate this vulnerability. reference: - https://dreyand.github.io/maian-cart-rce/ - https://github.com/DreyAnd/maian-cart-rce -...

elFinder < 2.1.58 - Remote Code Execution

studio-42/elfinder before 2.1.58 contains a remote code execution caused by execution of PHP code in a .phar file, letting attackers execute arbitrary PHP code if the server parses .phar files as PHP, exploit requires server to parse .phar files as PHP. id: CVE-2021-23394 info: name: elFinder...

elFinder <= 2.1.47 - Command Injection

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. The vulnerability occurs when performing image operations on JPEG files, where the filename is passed to the exiftran utility without proper sanitization, allowing command injection. id: CVE-2019-9194 info: name:...

Studio-42 elFinder <2.1.60 - Arbitrary File Upload

Studio-42 elFinder 2.0.4 to 2.1.59 is vulnerable to unauthenticated file upload via connector.minimal.php which could allow a remote user to upload arbitrary files and execute PHP code. id: CVE-2021-43421 info: name: Studio-42 elFinder 2.1.60 - Arbitrary File Upload author: akincibor severity:...

elFinder 2.1.58 - Remote Code Execution

elFinder 2.1.58 is impacted by multiple remote code execution vulnerabilities that could allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. id: CVE-2021-32682 info: name: elFinder 2.1.58 - Remote Code Executi...

elFinder <=2.1.60 - Local File Inclusion

elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. id: CVE-2022-26960 info: name: elFind...

CVE-2019-9194-elFinder-Command-Injection-PoC

CVE-2019-9194 — Inyección de Comandos en elFinder PoC Vulnerabilidad de inyección de comandos en elFinder = 2.1.47 a través del componente conector PHP. Permite ejecución remota de código sin autenticación como el usuario del servidor web. Cómo funciona Sube un JPEG válido con un nombre de archiv...

Python-CVE-2020-25213

Python-CVE-2020-25213 Exploit interactivo en Python para la vulnerabilidad de WP File Manager. El plugin File Manager wp-file-manager anterior a la versión 6.9 de WordPress permite a atacantes remotos subir y ejecutar código PHP arbitrario porque renombra un archivo de conector de ejemplo de...

CVE-2021-23394

elFinder CVE-2021-23394 复现环境搭建 本仓库包含一个使用 Docker 对 CVE-2021-23394 （elFinder 任意文件执行漏洞）的复现环境。它设置了四个环境，用于对比漏洞版本与修复版本在 Apache 和 Nginx 下的表现。 概述 本环境包含： 1. Apache 漏洞版本 （端口 8080）：elFinder 2.1.57 在 Apache 上运行 2. Apache 修复版本 （端口 8081）：elFinder 2.1.66 在 Apache 上运行 3. Nginx 漏洞版本 （端口 8082）：elFinder 2.1.57 在...

CVE-2026-81890

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:38+00:00| published-proof-of-concept| https://github.com/Studio-42/elFinder/security/advisories/GHSA-9hjf-w35w-6vx2...

CVE-2026-81891

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:35+00:00| published-proof-of-concept| https://github.com/Studio-42/elFinder/security/advisories/GHSA-gxmj-r5rf-ggwq 2026-09-04 00:05:19+00:00| seen| https://bsky.app/profile/opsmatters.com/post/3muno52zkqz23 2026-09-08 03:44:17+00:00|...

EUVD-2026-68800

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...

GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...