CVE-2019-9194

elFinder command injection vulnerability in the PHP connector

9.8 CriticalPublic exploitFix available

CVE-2019-9194 is a critical vulnerability (CVSS 9.8) in Std42 Elfinder, published February 26, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.7%, the 99th percentile. Fixed in studio-42/elfinder 2.1.48.

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

96.7%Up 67.2 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: CVE-2019-9194
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-78
Updated: 2026-11-02

CVE List No score

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: CVE-2019-9194
Updated: 2026-11-02

EUVDEUVD-2022-2262 No score

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: EUVD-2022-2262
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4223-qj94-7x9p 9.8

elFinder command injection vulnerability in the PHP connector

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: GHSA-4223-qj94-7x9p
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSV 9.8

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: CVE-2019-9194
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-4223-qj94-7x9p 9.8

elFinder command injection vulnerability in the PHP connector

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: GHSA-4223-qj94-7x9p
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

Affected products

std42 elfinder

Affected packages

Affected packages
Package	Affected	Fixed
`studio-42/elfinder` Packagist	before 2.1.48	2.1.48
`studio-42/elfinder` Packagist	before 2.1.48, plus listed versions 2.0.32.0.42.0.52.0.62.0.7 Show 45 moreShow less 2.0.82.0.92.1.02.1.12.1.102.1.112.1.122.1.132.1.142.1.152.1.162.1.172.1.182.1.192.1.22.1.202.1.212.1.222.1.232.1.242.1.252.1.262.1.272.1.282.1.292.1.32.1.302.1.312.1.322.1.332.1.342.1.352.1.362.1.372.1.382.1.392.1.42.1.402.1.412.1.422.1.432.1.442.1.452.1.462.1.47	2.1.48

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	elFinder 2.1.47 - 'PHP connector' Command Injection	2019-03-04
Exploit-DB	elFinder PHP Connector < 2.1.48 - 'exiftran' Command Injection (Metasploit)	2019-03-13
Metasploit	elFinder PHP Connector exiftran Command Injection	2019-02-26
Nuclei	elFinder <= 2.1.47 - Command Injection
PoC in GitHub	cved-sources/cve-2019-9194	2019-03-15
PoC in GitHub	estebanzarate/CVE-2019-9194-elFinder-Command-Injection-PoC	2026-02-18

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

References

Show 4 moreShow less

This page doesn't list everything

Left out here: 5 versions. The JSON record has them.