Skip to content
Threat Feed
Subscribe

Tag

ElFinder

2 briefs RSS
high advisory

elFinder MySQL Volume Driver SQL Injection (CVE-2026-44521)

An authenticated SQL injection vulnerability (CVE-2026-44521) exists in the elFinder MySQL volume driver (`elFinderVolumeMySQL`) allowing any logged-in user, including read-only users, to inject SQL through a crafted `target` file hash leading to unauthorized data disclosure and denial of service.

elfinder sql-injection web-application
2r 1t
high advisory

elFinder Command Injection via ImageMagick CLI in Resize Command

elFinder is vulnerable to command injection via the 'bg' parameter in the resize command when using the ImageMagick CLI backend, allowing arbitrary command execution as the web server process user.

elFinder command-injection imagemagick webserver
2r 1t