CVE-2026-41247: Critical Command Injection in elFinder Resize

CVE-2026-41247 is a critical command injection flaw (CVSS 9.8) in the elFinder web file manager. Before 2.1.67, a background color value in the resize command can reach a shell when the ImageMagick command line backend is in use. Upgrade to elFinder 2.1.67, or disable resize.

What's affected

Per the GitHub advisory for the Composer package studio-42/elfinder, versions before 2.1.67 are affected and 2.1.67 is patched.

The advisory narrows the exposure to configurations where all of these are true:

• The resize command is enabled.
• Image processing uses the ImageMagick CLI backend.
• The vulnerable code paths are reachable by the attacker.

Impact depends on those settings, and commands run as the web server user.

How to check if you're exposed

For PHP projects, check the installed version:

composer show studio-42/elfinder

For copies vendored by hand or bundled in a CMS plugin, look for the elFinder version string in its JavaScript or PHP files. Then check your connector options for the image library setting. If you use the GD or Imagick extension instead of the command line backend, the shell path in this advisory does not apply, though you should still update.

Also ask who can reach the file manager. If it is exposed to anonymous users, treat it as urgent.

What to do now

1. Upgrade elFinder to 2.1.67 or later.
2. If you cannot upgrade yet, apply the advisory's mitigations: disable the resize command if you do not need it, avoid the ImageMagick CLI backend, and restrict access to trusted users only.
3. Check web server and application logs for unusual resize requests.
4. Review the web server user's file permissions so a compromise reaches as little as possible.

Why it matters

The record lists CWE-78, OS command injection. The advisory says the bg value was passed into shell command strings without enough escaping. The fix validates it against a strict allowlist of color formats and escapes it before building the command.

This is a familiar pattern: a harmless looking option, such as a color, ends up inside a shell string. The safest design avoids the shell, but when that is not possible, allowlist the input and escape it. A static analysis pass can find these spots in your own code.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub advisory GHSA-8q4h-8crm-5cvc

Last reviewed: 19 October 2026.