CVE-2025-0818: elFinder Path Traversal Vulnerability

CVE-2025-0818 Overview

CVE-2025-0818 is a directory traversal vulnerability [CWE-22] affecting several WordPress plugins that bundle elFinder versions 2.1.64 and prior. The flaw allows unauthenticated attackers to delete arbitrary files on affected WordPress installations by manipulating file paths passed to the elFinder file management library. Exploitation requires that a site owner has explicitly exposed an instance of the elFinder file manager to users. Affected plugins include File Manager Advanced, Filester, and WP File Manager, all of which embed the vulnerable elFinder.class.php component.

Critical Impact
Unauthenticated attackers can delete arbitrary files on WordPress sites running vulnerable elFinder-based plugins, leading to potential site disruption and integrity loss.

Affected Products

WordPress Plugin: File Manager Advanced (embedded elFinder ≤ 2.1.64)
WordPress Plugin: Filester (embedded elFinder ≤ 2.1.64)
WordPress Plugin: WP File Manager (embedded elFinder ≤ 2.1.64)

Discovery Timeline

2025-08-13 - CVE-2025-0818 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0818

Vulnerability Analysis

The vulnerability resides in the elFinder PHP class shipped with several WordPress file management plugins. elFinder is an open-source, web-based file manager that exposes server-side file operations to clients through a PHP backend. The affected code path handles file deletion requests without adequately validating that supplied paths remain within the intended volume root.

An unauthenticated attacker can craft a request containing traversal sequences that resolve outside the plugin's configured working directory. The elFinder command handler then processes the delete operation against the resolved target, removing files elsewhere on the filesystem. Because the network attack vector requires no authentication or user interaction, any site that has publicly exposed a file manager instance is exposed.

Attack complexity is elevated because the site owner must first make the elFinder instance available to unauthenticated users, a non-default configuration. Deletion of files such as wp-config.php, plugin assets, or .htaccess can degrade site availability, break access controls, or force WordPress back into installation mode.

Root Cause

The root cause is insufficient path canonicalization and validation inside the elFinder delete handler at elFinder.class.php (around line 5367 upstream, and around lines 5378–5411 in the WordPress plugin forks). Path inputs are not properly restricted to the configured volume, allowing traversal sequences to escape the intended scope. This is a classic [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires a network-reachable elFinder endpoint exposed through one of the vulnerable WordPress plugins. The attacker submits a crafted delete command referencing a target path that resolves outside the plugin's file root. No credentials are required. Details of the vulnerable code paths and remediation are documented in the Wordfence Vulnerability Report and the upstream GitHub elFinder Class Source.

Detection Methods for CVE-2025-0818

Indicators of Compromise

Unexpected deletion of WordPress core files, plugin files, or .htaccess entries on sites running File Manager Advanced, Filester, or WP File Manager.
HTTP POST requests to admin-ajax.php or plugin AJAX endpoints containing elFinder cmd=rm operations with traversal sequences such as ../ in targets[] parameters.
Web server access logs showing unauthenticated requests to elFinder connector endpoints from unfamiliar IP addresses.

Detection Strategies

Inspect WordPress access logs for requests invoking elFinder commands (cmd=rm, cmd=paste, cmd=file) from unauthenticated sessions.
Monitor filesystem integrity on the WordPress webroot to detect unexpected file deletions in directories outside plugin-managed paths.
Deploy web application firewall rules that flag traversal patterns (..%2F, %2e%2e/) in requests targeting file manager plugin endpoints.

Monitoring Recommendations

Enable audit logging for all administrative WordPress plugins and correlate elFinder command invocations with authenticated user sessions.
Alert on any deletion of critical files such as wp-config.php, index.php, or plugin loader files.
Continuously scan installed WordPress plugins for embedded elFinder versions at or below 2.1.64.

How to Mitigate CVE-2025-0818

Immediate Actions Required

Update File Manager Advanced, Filester, and WP File Manager to the latest patched versions distributed through the WordPress plugin repository.
If patching is not immediately possible, disable or uninstall the affected file manager plugin until an updated version is applied.
Restrict access to elFinder connector endpoints so only authenticated administrators can invoke file operations.

Patch Information

Vendors have released updates via the WordPress plugin repository. See the WordPress Filester Changeset and the WordPress File Manager Changeset for the corrective code. Upstream fixes are tracked in the GitHub elFinder Repository.

Workarounds

Remove any publicly exposed elFinder instance and require WordPress authentication before invoking file manager AJAX handlers.
Apply web application firewall rules that block traversal sequences (../, encoded variants) in requests to plugin endpoints.
Enforce strict filesystem permissions so the PHP process cannot delete files outside the intended upload directories.

bash

# Example WAF rule (ModSecurity) blocking traversal in elFinder requests
SecRule REQUEST_URI "@rx (file-manager|filester|wp-file-manager)" \
  "chain,deny,status:403,id:1000818,msg:'Possible CVE-2025-0818 traversal'"
  SecRule ARGS "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:none,t:urlDecodeUni"