CVE-2026-41247

HighRCE

Published: 23 April 2026

Published

23 April 2026

Modified

28 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0157 72.1th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-41247 is a high-severity OS Command Injection (CWE-78) vulnerability in Std42 Elfinder. Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 27.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-41247 is a command injection vulnerability (CWE-78) affecting elFinder, an open-source web-based file manager written in JavaScript using jQuery UI, in versions prior to 2.1.67. The issue resides in the resize command, where the user-supplied "bg" (background color) parameter is accepted from input and passed through image resize/rotate processing. In configurations using the ImageMagick CLI backend, this parameter is incorporated into shell command strings without sufficient escaping, enabling potential injection.

An unauthenticated remote attacker (AV:N/AC:L/PR:N/UI:N) can exploit this vulnerability by invoking the resize command with a specially crafted "bg" value. Successful exploitation allows arbitrary command execution with the privileges of the web server process user, leading to high confidentiality, integrity, and availability impacts as reflected in the CVSS v3.1 base score of 9.8 (C:H/I:H/A:H/S:U).

The vulnerability is addressed in elFinder version 2.1.67. Additional details on the issue and mitigation are available in the GitHub security advisory at https://github.com/Studio-42/elFinder/security/advisories/GHSA-8q4h-8crm-5cvc.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-25281

Vulnerability details

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through…

image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2026-41247 is a command injection vulnerability in the public-facing web application elFinder, enabling unauthenticated remote attackers to achieve arbitrary command execution, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0