CVE-2026-81891

elFinder, an open-source web-based file manager built with JavaScript and jQuery UI, fails to normalize detected MIME types during ZIP archive extraction, so files with the .phtml, .phar, .php3, and .php5 extensions bypass uploadDeny rules that block text/x-php. An attacker who holds ZIP upload permission can exploit this by extracting PHP-executable files into the web-accessible files/ directory. If the web server is configured to execute those extensions, the attacker gains remote code execution on the hosting server. Any elFinder deployment prior to version 2.1.70 is affected, especially sites that relied on MIME-type denial rules to prevent PHP uploads. No public proof-of-concept or confirmed in-the-wild exploitation is currently known; EPSS estimates a 0.5% probability of exploitation within 30 days.

What to do: Upgrade elFinder to version 2.1.70 or later, which restores MIME-type normalization during extraction. Until patched, limit ZIP upload permissions to trusted users, confirm the web server does not execute .phtml/.phar/.php3/.php5 files within the files/ directory, and inspect that directory for already-extracted PHP-like files.