Quick answers
- Is CVE-2026-44521 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44521 being exploited in the wild.
- How severe is CVE-2026-44521?
- High severity, with a CVSS score of 8.8, published 27 May 2026.
- Which products and versions are affected?
- studio-42/elfinder (Packagist) <= 2.1.67, ECOSYSTEM:introduced=0,fixed=2.1.68; Studio-42 elFinder <= 2.1.67.
- Is there a fix for CVE-2026-44521?
- Yes. studio-42/elfinder (Packagist): upgrade to 2.1.68 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-44521 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-44521?
- Check whether you run studio-42/elfinder (Packagist) or Studio-42 elFinder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- studio-42/elfinder (Packagist): upgrade to 2.1.68 or later
composer require studio-42/elfinder:^2.1.68
Technical details
An authenticated SQL injection vulnerability exists in the elFinderVolumeMySQL driver. The root cause is the lack of validation when decoding file hashes passed via the 'target' parameter; these decoded values are used directly in MySQL driver queries such as cacheDir(), _joinPath(), _stat(), and _fopen(). Since the storage schema relies on numeric identifiers, an attacker can provide a crafted hash to manipulate SQL logic. This allows an authenticated user, even with read-only access, to disclose database metadata or trigger a denial of service via resource-intensive queries. The issue is patched in version 2.1.68.
Affected products
- Studio-42 elFinder <= 2.1.67
Identifiers
- CVE-2026-44521
- GHSA-c3gj-q88f-7hqj
Timeline
- 2026-05-07: disclosed
- 2026-05-11: advisory
- 2026-05-27: other: NVD published