CVE-2026-44521: elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL)

Synopsis

This is an authenticated SQL injection vulnerability in elFinder, the open-source web file manager, specifically within its MySQL volume driver (elFinderVolumeMySQL). The flaw is reachable over the network and requires only a low-privilege, logged-in account; any authenticated user, including read-only users, can craft a malicious file hash that injects SQL into the underlying database. Successful exploitation gives an attacker unauthorized read access to database contents and the ability to disrupt the service. Note: the description states the fix is version 2.1.68, but no patched release has been formally published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the elFinder web service via HTTP or HTTPS.

• AuthenticationRequired

  A valid user account is sufficient; even low-privilege or read-only accounts can supply the crafted file hash that triggers the injection.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no action from another user or administrator is needed.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race conditions, special memory layout, or environmental prerequisites are required to inject SQL reliably.

Blast Radius

• Reads arbitrary rows from the MySQL database backing elFinder, which may include stored credentials, file metadata, and application configuration.
• Discloses data from any table reachable by the database user configured for the MySQL volume driver, potentially extending beyond the elFinder schema.
• Causes denial of service by injecting queries that lock tables or exhaust database connections, making the file manager and dependent services unavailable.
• Integrity impact is rated High in the CVSS vector, meaning an attacker can modify or delete persisted database rows if the configured database account permits write operations.