CVE-2026-41247: elFinder: Command injection in resize background color parameter when using ImageMagick CLI
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.
Other sources
elFinder: Command injection in resize background color parameter when using ImageMagick CLI
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/studio-42/elfinderto a version that resolves this vulnerability.Fixed in 2.1.67 - Upgrade
Upgrade
elFinderto a version that resolves this vulnerability.Fixed in 2.1.67
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41247?
CVE-2026-41247 is classified as a critical vulnerability due to its potential for command injection.
How do I fix CVE-2026-41247?
To fix CVE-2026-41247, you should upgrade elFinder to version 2.1.67 or later to mitigate the vulnerability.
Who is affected by CVE-2026-41247?
CVE-2026-41247 affects users running elFinder versions prior to 2.1.67.
What impact does CVE-2026-41247 have on my system?
CVE-2026-41247 can allow an attacker to execute arbitrary commands on the server via crafted input.
Is CVE-2026-41247 a zero-day vulnerability?
CVE-2026-41247 is not a zero-day vulnerability as it has been disclosed and patches are available.