Executive brief
elFinder is a popular open-source file manager for the web. A security vulnerability in its MySQL storage component allows logged-in users to perform unauthorized database queries. This could lead to the theft of sensitive data or cause the file manager to become unavailable, even if the user only has basic read-only permissions.
Technical details
An authenticated SQL injection vulnerability exists in the elFinderVolumeMySQL driver. The root cause is the lack of validation when decoding file hashes passed via the 'target' parameter; these decoded values are used directly in MySQL driver queries such as cacheDir(), _joinPath(), _stat(), and _fopen(). Since the storage schema relies on numeric identifiers, an attacker can provide a crafted hash to manipulate SQL logic. This allows an authenticated user, even with read-only access, to disclose database metadata or trigger a denial of service via resource-intensive queries. The issue is patched in version 2.1.68.
Affected products
- Studio-42 elFinder <= 2.1.67
Timeline
- 2026-05-07: disclosed
- 2026-05-11: advisory
- 2026-05-27: other: NVD published