CVE-2026-41247: elFinder File Manager RCE Vulnerability

CVE-2026-41247 Overview

A command injection vulnerability has been identified in elFinder, an open-source file manager for web written in JavaScript using jQuery UI. Prior to version 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user.

Critical Impact

Unauthenticated attackers can achieve arbitrary command execution on vulnerable servers running elFinder with ImageMagick CLI backend enabled, potentially leading to full system compromise.

Affected Products

• elFinder versions prior to 2.1.67
• Systems using ImageMagick CLI backend for image processing
• Web servers hosting elFinder with image resize functionality enabled

Discovery Timeline

• 2026-04-23 - CVE CVE-2026-41247 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-41247

Vulnerability Analysis

This vulnerability is classified as CWE-78 (OS Command Injection), a critical weakness that allows attackers to execute arbitrary operating system commands on the host system. The flaw exists within elFinder's image resize functionality, specifically when the ImageMagick command-line interface is configured as the image processing backend.

When a user invokes the resize command, the bg parameter—intended to specify the background color for image operations—is passed directly to shell commands that invoke ImageMagick utilities. The application fails to properly sanitize or escape this user-controlled input before incorporating it into command strings. This oversight creates a direct path for command injection, where specially crafted input can break out of the intended command context and execute arbitrary shell commands.

The attack can be performed over the network without any prerequisites, authentication, or user interaction, making it particularly dangerous for internet-facing installations.

Root Cause

The root cause of this vulnerability lies in improper input validation and insufficient output encoding when constructing shell commands. The bg parameter value is concatenated directly into shell command strings without proper escaping of shell metacharacters. This allows attackers to inject additional commands using shell operators such as semicolons, backticks, or command substitution syntax.

The vulnerability specifically affects deployments using the ImageMagick CLI backend, where image manipulation commands are executed through system shell invocations rather than through language bindings or APIs that would avoid shell interpretation.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a malicious HTTP request to the elFinder endpoint with a crafted bg parameter value containing shell metacharacters and commands.

For example, an attacker could submit a resize request where the background color parameter contains shell escape sequences followed by arbitrary commands. When the server processes this request and constructs the ImageMagick command string, the injected commands are executed with the privileges of the web server process user.

The vulnerability is exploited through the image resize/rotate processing workflow:

1. Attacker sends a resize request with a malicious bg parameter value
2. The application constructs a shell command incorporating the unsanitized bg value
3. The shell interprets metacharacters in the bg value as command separators
4. Injected commands execute with web server user privileges

For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-41247

Indicators of Compromise

• Unusual process spawning from the web server process (e.g., www-data, apache, or nginx user)
• Shell commands or unexpected binaries executed with web server privileges
• HTTP requests to elFinder endpoints containing suspicious characters in the bg parameter (semicolons, backticks, $(), pipe characters)
• Unexpected outbound network connections from the web server

Detection Strategies

• Monitor web application logs for requests to elFinder resize endpoints containing shell metacharacters in parameters
• Implement Web Application Firewall (WAF) rules to detect and block command injection patterns in HTTP parameters
• Deploy endpoint detection solutions that monitor for anomalous child processes spawned by web server processes
• Audit ImageMagick command execution logs for malformed or suspicious command arguments

Monitoring Recommendations

• Enable detailed logging for elFinder operations, particularly image processing functions
• Configure alerting for any shell command execution originating from the web server user context that doesn't match expected patterns
• Monitor for creation of new files in web-accessible directories by the web server process
• Implement network egress filtering and monitor for unexpected outbound connections from web server hosts

How to Mitigate CVE-2026-41247

Immediate Actions Required

• Upgrade elFinder to version 2.1.67 or later immediately
• If immediate upgrade is not possible, disable the resize functionality or restrict access to the elFinder endpoint
• Consider switching from the ImageMagick CLI backend to a safer alternative that doesn't invoke shell commands
• Review access controls and ensure elFinder is not exposed to untrusted users or the public internet

Patch Information

The vulnerability has been fixed in elFinder version 2.1.67. Organizations should update to this version or later to remediate the vulnerability. The fix implements proper escaping and sanitization of the bg parameter before it is incorporated into shell commands.

For more information about the patch, see the GitHub Security Advisory.

Workarounds

• Disable the image resize functionality if not required for business operations
• Restrict access to elFinder endpoints using network-level controls (firewall rules, IP whitelisting)
• Switch to a non-CLI image processing backend that doesn't invoke shell commands (e.g., GD library or Imagick PHP extension)
• Implement WAF rules to filter requests containing shell metacharacters in the bg parameter

# Example: Restrict access to elFinder in Apache
<Location "/path/to/elfinder">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>