CVE-2026-81891 elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Attackers can bypass MIME filters to upload and execute PHP files via ZIP extraction, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81891?
CVE-2026-81891 is a high-severity vulnerability in Studio-42 elFinder, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.
Weakness: CWE-434
Which versions are affected by CVE-2026-81891?
2 open source packages ship an affected version, including Studio-42/elFinder.
| Package | Affected | Fixed in |
|---|---|---|
Studio-42/elFinder Packagist | All versions | 2.1.70 |
Studio-42/elFinder Packagist | All versions | 2.1.70 |
How do I fix CVE-2026-81891?
Upgrade Studio-42/elFinder to 2.1.70 or later.
Is CVE-2026-81891 being exploited?
There is no known exploitation of CVE-2026-81891 in the wild and no public exploit code.
Sources
Also known as GHSA-gxmj-r5rf-ggwq.