GHSA-8q4h-8crm-5cvc
Critical · 9.8elFinder: Command injection in resize background color parameter when using ImageMagick CLI
CVSS
9.8
EPSS
—
Published
Apr 17, 2026
CISA due date
—
The record
elFinder contains a command injection vulnerability in the `resize` command. The `bg` (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the `resize` command with a crafted `bg` value may achieve arbitrary command execution as the web server process user. This issue affects configurations where: - the `resize` command is enabled, - image processing uses the ImageMagick CLI backend, and - the vulnerable code paths are reachable.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-41247 elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Same vulnerability
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-112943 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-78