elFinder command injection vulnerability in the PHP connector

CRÍTICO 9.8CVE-2019-9194 · GHSA-4223-qj94-7x9p · Published 26/02/2019 · updated 17/06/2026

En resumen

CVE-2019-9194 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a studio-42/elfinder, elfinder (std42).
Probabilidad de explotación en los próximos 30 días (EPSS): 96.7%, mayor que el 99.9% de las vulnerabilidades.
Solución: actualizar a 2.1.48 o posterior.

Package	Affected versions	Patched versions
studio-42/elfinder Packagist	`< 2.1.48`	`2.1.48`
elfinder std42	`< 2.1.48`	`2.1.48`

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

NVD description

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

< 2.1.48

2.1.48

< 2.1.48

2.1.48

Más vulnerabilidades de studio-42/elfinder

Ver todo →