Composer studio-42/elfinder has 18 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2019-9194 | elFinder command injection vulnerability in the PHP connector | critical | 9.8 | <2.1.48 | 2.1.48 |
| CVE-2021-32682 | elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE | critical | 9.8 | <2.1.59 | 2.1.59 |
| CVE-2022-26960 | Path Traversal in Studio-42 elFinder through 2.1.60 | critical | 9.1 | <2.1.61 | 2.1.61 |
| CVE-2021-43421 | elFinder Unrestricted File Upload vulnerability | critical | 9.8 | >=2.0.4 and <2.1.60 | 2.1.60 |
| CVE-2022-27115 | RCE in Studio-42 elFinder on Windows before 2.1.61 | critical | 9.8 | <2.1.61 | 2.1.61 |
| CVE-2021-23394 | elFinder unsafe upload filtering leading to remote code execution | high | 8.1 | <2.1.58 | 2.1.58 |
| CVE-2018-9109 | elFinder Path Traversal vulnerability | critical | 9.1 | <2.1.36 | 2.1.36 |
| CVE-2018-9110 | Directory Traversal in Studio 42 elFinder | critical | 9.1 | >=2.1.12 and <2.1.37 | 2.1.37 |
| CVE-2023-35840 | elFinder vulnerable to path traversal in LocalVolumeDriver connector | high | 7.5 | <2.1.62 | 2.1.62 |
| CVE-2026-41247 | elFinder: Command injection in resize background color parameter when using ImageMagick CLI | critical | 9.8 | <2.1.67 | 2.1.67 |
| CVE-2019-5884 | Sensitive Data Exposure in elFinder | medium | 5.9 | <2.1.45 | 2.1.45 |
| CVE-2019-6257 | elFinder Server Side Request Forgery (SSRF) | high | 7.7 | <2.1.49 | 2.1.49 |
| CVE-2026-81891 | elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE) | high | 8.1 | <2.1.70 | 2.1.70 |
| CVE-2021-45919 | Studio 42 elFinder allows stored XSS | medium | 5.4 | <=2.1.31 | – |
| CVE-2026-81889 | elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback | high | 8.6 | <2.1.70 | 2.1.70 |
| CVE-2024-38909 | Studio 42 elFinder vulnerable to Incorrect Access Control | critical | 9.8 | <=2.1.64 | – |
| CVE-2026-44521 | elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL) | high | 8.8 | <2.1.68 | 2.1.68 |
| CVE-2026-81890 | elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections | medium | 5.4 | <2.1.70 | 2.1.70 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked