CVE-2026-81891 in elFinder
Summary
by MITRE • 08/31/2026
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in elFinder, specifically within versions prior to 2.1.70, represents a critical logic flaw in the file extraction mechanism that allows for remote code execution through MIME type misclassification and insufficient validation of allowed extensions. ElFinder is an open-source web-based file manager implemented in JavaScript with jQuery UI dependencies, widely deployed in content management systems and enterprise applications to facilitate user interaction with server-side files. The core issue resides in the php/elFinderVolumeDriver.class.php file, specifically within the checkExtractItems() function which governs how archived contents are processed upon extraction from uploaded ZIP archives.
The technical root cause stems from an incomplete normalization of MIME types during the detection phase. When elFinder processes a ZIP archive for extraction, it invokes mimetypeInternalDetect() to identify the content type of each file contained within the archive. However, the output of this function is not passed through mimeTypeNormalize(), which serves as a critical sanitization and mapping layer in the application's security logic. This omission means that files with extensions such as .phtml, .phar, .php5, or .php3 are detected based on their file extension rather than being mapped to the canonical PHP MIME type text/x-php via the staticMimeMap configuration. Because these specific extensions are typically absent from standard system mime.types files, the internal detection logic fails to recognize them as PHP scripts in a normalized manner, leading to inconsistent behavior across different server configurations and library versions.
This technical flaw directly impacts the access control mechanisms designed to prevent malicious file uploads. The application relies on allowPutMime() to determine whether a specific MIME type is permitted for storage or execution within designated directories. Since the malformed detection process fails to map these PHP-like extensions to text/x-php, the security check incorrectly concludes that the files are safe because they do not match the blocked text/x-php entry in uploadDeny lists. Consequently, an attacker who possesses permission to upload ZIP archives can craft a malicious archive containing PHP executable scripts with non-standard extensions like .phar or .phtml. Upon extraction into a web-accessible directory such as files/, these scripts are saved without triggering the MIME-based blocklists that would otherwise prevent their storage if they were correctly identified as PHP code.
The operational impact of this vulnerability is severe, resulting in remote code execution (RCE) under specific server configurations where the web server interprets extensions like .phtml or .phar as executable PHP scripts. Once these files are extracted and stored in a publicly accessible directory, an attacker can simply request the URL corresponding to one of these malicious files via HTTP GET requests. The web server then processes the file using its configured handler for that extension, executing arbitrary code with the privileges of the web service account. This effectively bypasses multiple layers of defense including upload restrictions and MIME type filtering, allowing full compromise of the underlying system depending on the permissions granted to the web process.
From a classification perspective, this vulnerability aligns with CWE-436: Interpretation Conflict, where different components or parsers interpret the same data differently due to ambiguous rules or missing normalization steps. It also relates closely to CWE-20: Improper Input Validation, as the application fails to adequately validate and normalize input derived from archive contents before making security decisions. In terms of offensive tactics, this exploit maps directly to MITRE ATT&CK technique T1505.003: Web Shell: PHP Webshell, where attackers deploy malicious scripts to maintain persistent access and execute commands on the compromised host.
Mitigation strategies primarily involve upgrading elFinder to version 2.1.70 or later, which resolves this issue by ensuring that all detected MIME types are properly normalized through mimeTypeNormalize() before being evaluated against security policies. For organizations unable to immediately patch their systems, defensive measures include configuring web servers like Apache or Nginx to explicitly deny execution of files with extensions such as .phtml, .phar, .php5, and .php3 in upload directories regardless of MIME type detection results. Additionally, implementing strict allowlists for permitted file extensions during the extraction process can provide an additional layer of defense against this specific attack vector. Regular auditing of web server configurations to ensure that no executable scripts are stored in public-facing directories remains a best practice for maintaining secure file management operations.