CVE-2019-9194

elFinder command injection vulnerability in the PHP connector

9.8 CriticalPublic exploitFix available

CVE-2019-9194 is a critical vulnerability (CVSS 9.8) in Std42 Elfinder, published February 26, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.7%, the 99th percentile. Fixed in studio-42/elfinder 2.1.48.

Severity: 9.8 CriticalCVSS 3.0, NVD
Exploit chance: 96.7%EPSS, 99th percentile
Exploitation: None known6 public exploits
Fixed in: 2.1.48studio-42/elfinder +1 more

Description

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

96.7%Up 67.2 points since Apr 14, 2021

Affected products

std42 elfinder

Affected packages

Affected packages
Package	Affected	Fixed
`studio-42/elfinder` Packagist	before 2.1.48	2.1.48
`studio-42/elfinder` Packagist	before 2.1.48, plus listed versions 2.0.32.0.42.0.52.0.62.0.7 Show 45 moreShow less 2.0.82.0.92.1.02.1.12.1.102.1.112.1.122.1.132.1.142.1.152.1.162.1.172.1.182.1.192.1.22.1.202.1.212.1.222.1.232.1.242.1.252.1.262.1.272.1.282.1.292.1.32.1.302.1.312.1.322.1.332.1.342.1.352.1.362.1.372.1.382.1.392.1.42.1.402.1.412.1.422.1.432.1.442.1.452.1.462.1.47	2.1.48

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	elFinder PHP Connector exiftran Command Injection	2019-02-26
Exploit-DB	elFinder 2.1.47 - 'PHP connector' Command Injection	2019-03-04
Exploit-DB	elFinder PHP Connector < 2.1.48 - 'exiftran' Command Injection (Metasploit)	2019-03-13
PoC in GitHub	cved-sources/cve-2019-9194	2019-03-15
PoC in GitHub	estebanzarate/CVE-2019-9194-elFinder-Command-Injection-PoC	2026-02-18
Nuclei	elFinder <= 2.1.47 - Command Injection

What each source reports

NVD Score used9.8

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: CVE-2019-9194
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-78
Updated: 2026-11-02

CVE ListNo score

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: CVE-2019-9194
Updated: 2026-11-02

EUVDEUVD-2022-2262No score

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: EUVD-2022-2262
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4223-qj94-7x9p9.8

elFinder command injection vulnerability in the PHP connector

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: GHSA-4223-qj94-7x9p
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSV9.8

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: CVE-2019-9194
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-4223-qj94-7x9p9.8

elFinder command injection vulnerability in the PHP connector

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Record: GHSA-4223-qj94-7x9p
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 10, 2026	exploits, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 4 moreShow less

This page doesn't list everything

Left out here: 5 versions. The JSON record has them.