CVE-2026-41247

CriticalRCE

Published: 23 April 2026

Published

23 April 2026

Modified

28 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0016 36.8th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41247 is a critical-severity OS Command Injection (CWE-78) vulnerability in Std42 Elfinder. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Requires identification, reporting, and correction of the specific command injection flaw in elFinder's resize command fixed in version 2.1.67.

SI-10 Information Input Validation good match

prevent

Checks the validity of user-supplied bg parameter to block shell command injection into ImageMagick CLI processing.

RA-5 Vulnerability Monitoring and Scanning good match

detect

Scans for and identifies vulnerable elFinder versions affected by CVE-2026-41247 to enable remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2026-41247 is a command injection vulnerability in the public-facing web application elFinder, enabling unauthenticated remote attackers to achieve arbitrary command execution, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through…

image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.

Deeper analysisAI

CVE-2026-41247 is a command injection vulnerability (CWE-78) affecting elFinder, an open-source web-based file manager written in JavaScript using jQuery UI, in versions prior to 2.1.67. The issue resides in the resize command, where the user-supplied "bg" (background color) parameter is accepted from input and passed through image resize/rotate processing. In configurations using the ImageMagick CLI backend, this parameter is incorporated into shell command strings without sufficient escaping, enabling potential injection.

An unauthenticated remote attacker (AV:N/AC:L/PR:N/UI:N) can exploit this vulnerability by invoking the resize command with a specially crafted "bg" value. Successful exploitation allows arbitrary command execution with the privileges of the web server process user, leading to high confidentiality, integrity, and availability impacts as reflected in the CVSS v3.1 base score of 9.8 (C:H/I:H/A:H/S:U).

The vulnerability is addressed in elFinder version 2.1.67. Additional details on the issue and mitigation are available in the GitHub security advisory at https://github.com/Studio-42/elFinder/security/advisories/GHSA-8q4h-8crm-5cvc.