CVE-2021-43421: STD42 Elfinder

Critical severity, CVSS 9.8. EPSS: 42.8% chance of exploitation in the next 30 days.

A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.

Affected products

• STD42 Elfinder: from 2.0.4, up to and including 2.1.59

Published 2022-04-07. Last modified 2026-06-17.