Threats tagged 'ghsa-8q4h-8crm-5cvc'

elFinder versions prior to 2.1.67 contain a command injection vulnerability in the resize command's background color (bg) parameter when using the ImageMagick CLI backend. This allows an attacker to inject shell commands due to insufficient escaping of the bg parameter, potentially leading to remote code execution with the web server's privileges. The vulnerability is fixed in version 2.1.67 by validating and escaping the bg parameter. Mitigations include disabling the resize command, avoiding the ImageMagick CLI backend, or restricting access until patched.