Listen to this Post
elFinder is an open-source web-based file manager, widely integrated into content management systems and enterprise applications. It provides `uploadDeny` and `uploadAllow` configuration options to restrict which MIME types may be uploaded. When `uploadDeny` includes text/x-php, the direct upload of .php, .phtml, and `.phar` files is correctly blocked.
However, a critical flaw exists in the ZIP extraction logic. The `extract` command internally calls `checkExtractItems()` in elFinderVolumeDriver.class.php. This function invokes `mimetypeInternalDetect()` to determine the MIME type of files being extracted, but crucially, it does not pass the result through mimeTypeNormalize().
For direct uploads, the validation pipeline is:
1. `mimetype()` → `mimetypeInternalDetect()` (stage 1: extension → MIME via mime.types)
2. `mimeTypeNormalize()` (stage 2: apply `staticMimeMap` to map extensions like `phtml:` → text/x-php)
3. `allowPutMime()` (blocks `text/x-php` if in `uploadDeny`)
During ZIP extraction, stage 2 (mimeTypeNormalize) is skipped. Because extensions like .phtml, .phar, .php5, and `.php3` are absent from standard `mime.types` files, `mimetypeInternalDetect()` returns a generic type such as application/octet-stream. Without mimeTypeNormalize(), the `staticMimeMap` entries that would map these to `text/x-php` are never applied. Consequently, `allowPutMime()` sees a non-blocked MIME type and permits the extraction.
An attacker with ZIP upload permission can craft a malicious archive containing PHP-executable scripts with these extensions. Upon extraction into a web-accessible directory such as files/, these scripts are saved without triggering the MIME-based blocklists. If the web server is configured to execute these extensions as PHP—which is common in Apache and Nginx deployments—this results in Remote Code Execution (RCE). The vulnerability is fixed in version 2.1.70.
DailyCVE Form:
Platform: elFinder < 2.1.70
Version: 2.1.69 and earlier
Vulnerability: Unrestricted File Upload (CWE-434)
Severity: High (CVSS 8.1)
Date: 2026-08-31
Prediction: Patch available (upgrade to 2.1.70)
What Undercode Say:
The vulnerability stems from an inconsistent application of the MIME validation pipeline. The `checkExtractItems()` function in `php/elFinderVolumeDriver.class.php` (line 7110) fails to call mimeTypeNormalize(). This oversight allows files with extensions like .phtml, .phar, .php5, and `.php3` to bypass the `uploadDeny` filter during ZIP extraction.
Affected Extensions Confirmed:
– `.phtml`
– `.phar`
– `.php5`
– `.php3`
Not Bypassed:
– `.php` (present in mime.types, detected as `text/x-php` in stage 1)
Exploit:
Step 1: Create a benign PHP payload echo '<?php phpinfo(); ?>' > hello.phtml Step 2: Create a ZIP archive containing the payload zip bypass.zip hello.phtml Step 3: Upload bypass.zip via elFinder's upload functionality (MIME: application/zip is allowed) Step 4: Extract the ZIP using elFinder's "Extract" command The file hello.phtml is extracted to the web-accessible files/ directory Step 5: Execute the extracted PHP file by accessing it via a web browser http://<target>/elFinder/files/hello.phtml
Protection:
- Immediate: Upgrade elFinder to version 2.1.70 or later.
2. If immediate patching is not possible:
Restrict or disable the ZIP “extract” command for untrusted or low-privileged users.
Ensure the web server does not execute uploaded/extracted files as PHP outside of intended application directories (e.g., disable PHP handler execution in upload/extraction directories via `.htaccess` or equivalent Nginx configuration).
3. Review the `uploadDeny/uploadAllow` configuration to ensure it is combined with server-side execution restrictions on upload directories.
Impact:
Successful exploitation results in:
- Arbitrary PHP code execution on the web server
- Full server environment disclosure via `phpinfo()` (paths, PHP version, loaded modules, environment variables)
- Potential access to the server filesystem, database credentials, and internal network services
- Complete compromise of the web application if an attacker substitutes `phpinfo()` with a web shell (e.g.,
<?php system($_GET['cmd']); ?>)
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
