A command injection flaw exists in elFinder's resize operation when the background color parameter is supplied during ImageMagick CLI processing. The bg value is directly concatenated into a shell command without proper escaping, per CWE-78. An attacker who can trigger the resize command with a crafted background color string can run arbitrary commands under the web server account, compromising the server's confidentiality, integrity, and availability.

Studio‑42 elFinder versions prior to 2.1.67 are affected. The vulnerability applies to deployments that use the ImageMagick CLI backend for image manipulation, which is commonly enabled in many web‑hosted file managers.

With a CVSS score of 8.9 the flaw is high severity, but the EPSS score of less than 1 % indicates a low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. The attack vector is remote through the web application; an attacker needs only the ability to invoke the resize command via HTTP. Once executed, commands run with the privileges of the web server process, offering full control on the affected host.