An improper MIME type validation flaw in Studio-42 elFinder prior to version 2.1.70 enables unauthenticated remote code execution.

The vulnerability exists in the checkExtractItems function within php/elFinderVolumeDriver.class.php, where improper normalization of MIME types allows the extraction of prohibited PHP-executable file types. This flaw allows an unauthenticated attacker with ZIP upload permissions to bypass security filters and execute arbitrary code on the host server.

The ability to achieve remote code execution poses a critical threat to the confidentiality, integrity, and availability of the host system. Given the CVSS score of 8.1, this vulnerability allows an attacker to gain full control over the web application, potentially leading to total data compromise, lateral movement within the network, and significant reputational damage.

Immediate Action: Upgrade to elFinder version 2.1.70 or later immediately to incorporate the necessary MIME type normalization fixes.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the files directory, specifically looking for attempts to access non-standard PHP extensions such as .phtml, .phar, .php5, or .php3.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized file uploads and restrict access to the file manager directory, ensuring that only trusted users can interact with the upload functionality.

Public Exploit Available: No (exploit_available is false).

This vulnerability represents a significant security risk due to the potential for remote code execution. Administrators must prioritize updating to version 2.1.70 to ensure that file type validation mechanisms are properly enforced. Failure to apply this update leaves the application susceptible to unauthorized code execution by unauthenticated actors.