elFinder's resize function accepts a background color parameter (bg) that is passed to ImageMagick’s CLI backend. The value is concatenated directly into a shell command without proper escaping, a classic case of CWE-78. An attacker who can trigger the resize operation with a crafted bg value can execute shell commands under the web server’s user account, compromising the integrity and confidentiality of the entire hosting environment.

Studio‑42 elFinder versions prior to 2.1.67 are affected. The flaw applies to deployments that use the ImageMagick CLI backend for image manipulation, which is commonly enabled in many web-hosted file managers.

With a CVSS score of 8.9 the flaw is high severity, but the EPSS score of 2% indicates a very low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. Based on the description, it is inferred that the attack vector is remote through the web application; an attacker would need the ability to invoke the resize command via HTTP. Once executed, commands run with the privileges of the web server process, offering full control on the affected host.