CVE-2026-41247: elFinder: Command injection in resize background color parameter when using ImageMagick CLI
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41247?
CVE-2026-41247 is classified as a critical vulnerability due to its potential for command injection.
How do I fix CVE-2026-41247?
To fix CVE-2026-41247, you should upgrade elFinder to version 2.1.67 or later to mitigate the vulnerability.
Who is affected by CVE-2026-41247?
CVE-2026-41247 affects users running elFinder versions prior to 2.1.67.
What impact does CVE-2026-41247 have on my system?
CVE-2026-41247 can allow an attacker to execute arbitrary commands on the server via crafted input.
Is CVE-2026-41247 a zero-day vulnerability?
CVE-2026-41247 is not a zero-day vulnerability as it has been disclosed and patches are available.