elFinder command injection vulnerability in the PHP connector

CRITICAL 9.8CVE-2019-9194 · GHSA-4223-qj94-7x9p · Published 26/02/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
studio-42/elfinder Packagist	`< 2.1.48`	`2.1.48`
elfinder std42	`< 2.1.48`	`2.1.48`

Description

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

NVD description

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.