CVE-2026-81891

High

Advisory

Published 2 Sept 2026In the index since 6 Sept 2026

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
studio-42/elfindercomposer	2.1.65, 2.1.69	2.1.70	2

2 by stars

Chart

Latest

Affected images

Radar Score

mauticone-acre-fund

1 of the 3 container images this version deploys carry CVE-2026-81891.

Container image	Digest	Package	Fixed in
mautic/mautic :v4-apache	94ea4acf4049	studio-42/elfinder@2.1.65	2.1.70

2,667

mauticmautic-chart

1 of the 3 container images this version deploys carry CVE-2026-81891.

Container image	Digest	Package	Fixed in
mautic/mautic :7-apache	eb8cc73d97e1	studio-42/elfinder@2.1.69	2.1.70

8,303

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
mautic/mautic :v4-apache	94ea4acf4049	studio-42/elfinder@2.1.65	2.1.70	1
mautic/mautic :7-apache	eb8cc73d97e1	studio-42/elfinder@2.1.69	2.1.70	1