CVE-2019-9194: STD42 Elfinder

Critical severity, CVSS 9.8. EPSS: 96.7% chance of exploitation in the next 30 days.

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Affected products

• STD42 Elfinder: before 2.1.48 (fixed in 2.1.48)

Published 2019-02-26. Last modified 2026-06-17.