PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44521 Studio-42 CVE debrief

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.68, an authenticated SQL injection vulnerability in the elFinder MySQL volume driver (elFinderVolumeMySQL) allows any logged-in user, including users with read-only access to the affected volume, to inject SQL through a crafted target file hash. Successful exploitation can lead to unauthorized data disclosure and denial of service. This vulnerability only affects installations configured to use the MySQL volume driver. This vulnerability is fixed in 2.1.68.

Vendor
Studio-42
Product
elFinder
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running elFinder with MySQL volume driver configurations, particularly those with multi-user deployments where read-only access is granted to untrusted users. Security teams responsible for web application security and database integrity in environments using elFinder file management capabilities.

Technical summary

The elFinder MySQL volume driver (elFinderVolumeMySQL) fails to properly sanitize user-supplied input in file hash parameters, allowing authenticated users to inject arbitrary SQL commands. Any logged-in user with read-only access or higher can exploit this by crafting a malicious target file hash. The vulnerability is confined to deployments using the MySQL volume driver and does not affect default or other storage configurations. Successful exploitation can result in complete database compromise, unauthorized data exfiltration, and service disruption.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade elFinder to version 2.1.68 or later to remediate this vulnerability.
  • If immediate patching is not possible, disable or restrict access to MySQL volume driver configurations.
  • Review database access logs for anomalous queries that may indicate exploitation attempts.
  • Apply principle of least privilege to database accounts used by elFinder MySQL volume driver.
  • Monitor for unauthorized data access patterns or unexpected denial of service conditions in elFinder deployments.

Evidence notes

CVE published 2026-05-27. CVSS 8.8 (HIGH). Affects elFinder versions prior to 2.1.68. Attack vector: network, low complexity, low privileges required, no user interaction. Confidentiality, integrity, and availability impacts are all high. CWE-89 (SQL Injection).

Official resources

2026-05-27