CVE-2026-81891: elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
elFinderto a version that resolves this vulnerability.Fixed in 2.1.70
Event History
Frequently Asked Questions
Which deployments are actually exposed to remote code execution?
Deployments prior to 2.1.70 are exposed when users can upload ZIP archives, extract them through elFinder, and the extracted files are placed in a web-accessible files/ directory where the web server executes PHP-related extensions such as .phtml, .phar, .php5, or .php3.
Does exploitation require an authenticated account or user interaction?
The issue requires ZIP upload permission, but no additional privileges or user interaction are described. An attacker must be able to include a PHP-executable file in a ZIP archive and trigger its extraction.
Why might an upload deny rule for PHP not prevent this?
Before 2.1.70, ZIP extraction does not normalize the detected MIME type before evaluating the filter. As a result, uploadDeny rules blocking text/x-php can be bypassed for extensions absent from mime.types, including .phtml, .phar, .php5, and .php3.
What is the available fix?
Upgrade elFinder to version 2.1.70, which fixes the MIME-type normalization issue in ZIP extraction.