CVE-2026-81891: CWE-434: Unrestricted Upload of File with Dangerous Type in Studio-42 elFinder

The vulnerability arises because the function checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without normalizing MIME types via mimeTypeNormalize(). Since certain PHP-related extensions (.phtml, .phar, .php5, .php3) are missing from the mime.types file, their MIME types are not correctly mapped to text/x-php. Consequently, allowPutMime() permits extraction of these files even when uploadDeny blocks text/x-php types. An attacker with permission to upload ZIP files can exploit this to place PHP-executable files in a web-accessible directory, enabling remote code execution when the server processes these files. The vulnerability is resolved in elFinder version 2.1.70.

Successful exploitation allows an unauthenticated attacker with ZIP upload permissions to execute arbitrary PHP code on the server by extracting malicious PHP files into a web-accessible directory. This leads to full compromise of confidentiality, integrity, and availability of the affected system.

A fix is available in elFinder version 2.1.70. Users should upgrade to this version or later to remediate the vulnerability. No vendor advisory was provided to indicate alternative mitigations or temporary fixes. Until upgrading, restrict ZIP upload permissions to trusted users only.