CVE-2019-9194 — elFinder command injection vulnerability in the PHP connector

Description

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

elFinder PHP Connector exiftran Command Injection
exploit/unix/webapp/elfinder_php_connector_exiftran_cmd_injection

Exploit-DB 2

elFinder PHP Connector < 2.1.48 - 'exiftran' Command Injection (Metasploit) EDB-46539 · remote · Mar 13, 2019 · verified
elFinder 2.1.47 - 'PHP connector' Command Injection EDB-46481 · webapps · Mar 4, 2019 · verified

GitHub 2 repositories

estebanzarate/CVE-2019-9194-elFinder-Command-Injection-PoC ★ 2 · Feb 18, 2026

Command injection vulnerability in elFinder <= 2.1.47 via the PHP connector component. Allows unauthenticated remote code execution as the web server user.
cved-sources/cve-2019-9194 ★ 0 · Mar 15, 2019

cve-2019-9194

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

elFinder <= 2.1.47 - Command Injection http/cves/2019/CVE-2019-9194.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	studio-42/elfinder	< 2.1.48	2.1.48	GHSA-4223-qj94-7x9p

elFinder command injection vulnerability in the PHP connector