Studio-42 vulnerabilities
We track 4 vulnerabilities in Studio-42 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 31, 2026.
Latest Studio-42 vulnerabilities
- 8.1 High severity
elFinder: Unrestricted Upload of File with Dangerous Type
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because th
- 8.6 High severity
elFinder: Server-Side Request Forgery
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() v
- 8.8 High severity
elFinder: Improper Neutralization of Special Elements used in an SQL Command
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.68, an authenticated SQL injection vulnerability in the elFinder MySQL volume driver (elFinderVolumeMySQL) allows any logged-in user, including users with read
- 9.8 Critical severity
elFinder: Improper Neutralization of Special Elements used in an OS Command
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed throu