Description

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-31T21:17:52.757Z",
  "pubdate": "2026-08-31T21:17:52.757Z",
  "executiveSummary": "A critical security vulnerability exists in elFinder prior to version 2.1.70, involving improper validation of MIME types during archive extraction.\nThe vulnerability occurs because the checkExtractItems() function fails to normalize MIME types retrieved via mimetypeInternalDetect().\nThis deficiency allows an attacker with ZIP upload permissions to bypass uploadDeny security filters, specifically those intended to restrict text/x-php files.\nBy uploading a crafted ZIP archive containing malicious PHP scripts with extensions such as .phtml, .phar, .php5, or .php3, an attacker can extract these files into web-accessible directories.\nSuccessful exploitation results in Remote Code Execution (RCE) if the web server is configured to interpret these extensions as executable PHP code.\nThe vulnerability represents a significant risk as it allows unauthorized remote code execution, potentially leading to a full system compromise depending on the web server's execution environment and directory permissions.",
  "technicalDetails": "The vulnerability is rooted in the handling of archive extraction within the php/elFinderVolumeDriver.class.php component. Specifically, the checkExtractItems() function invokes mimetypeInternalDetect() to identify the MIME type of files contained within a ZIP archive. Crucially, the function fails to pass the detection result through mimeTypeNormalize() before subsequent processing.\nThe underlying issue stems from a configuration gap in mime.types, where specific PHP-associated extensions (.phtml, .phar, .php5, and .php3) are absent. Consequently, the staticMimeMap entries—which would normally categorize these files as text/x-php—are not applied during the detection process. Because the MIME type is not normalized, the allowPutMime() function evaluates the extracted file based on incomplete or incorrect MIME type information.\nThe exploitation flow begins when an authenticated attacker with file upload privileges uploads a ZIP archive containing malicious PHP code disguised with one of the omitted extensions. When the user initiates an extraction command, the affected checkExtractItems() logic fails to trigger the relevant uploadDeny security checks that would normally block the text/x-php MIME type. As a result, the application allows the extraction of the malicious payload into a target, web-accessible directory.\nOnce extracted, the attacker can trigger the malicious script by directly requesting the file path via the web server. If the server environment is configured to parse these specific extensions as PHP, the server will execute the attacker's code, granting the attacker arbitrary command execution capabilities within the security context of the web server process.\nThis flaw affects elFinder versions prior to 2.1.70. It requires that the attacker has existing permission to upload ZIP archives and that the server environment supports the execution of the bypassed PHP extensions."
}