https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T04:20:55.194661+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-41247 CVE-2026-41247 — elFinder: Command injection in resize background color parameter when using ImageMagick CLI 2026-10-07T04:20:55.210748+00:00

Affected: Studio-42 elFinder

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.