elFinder, a web‑based file manager, contains a flaw in its ZIP extraction routine that bypasses the uploadDeny MIME filter. The checkExtractItems() function calls mimetypeInternalDetect() without normalizing the MIME type, causing the static MIME map for PHP extensions (.phtml, .phar, .php5, .php3) to be ignored. As a result, an attacker who can upload ZIP files can place PHP‑code files inside the web‑accessible files/ directory and obtain remote code execution. The vulnerability is a type of improper file type filtering (CWE-434).

The flaw impacts installations of Studio-42’s elFinder version 2.1.69 and earlier. Upgrading to 2.1.70 or later applies the patch that restores the MIME type check and blocks PHP file extraction.

The CVSS score is 8.1, indicating high severity. The EPSS score is not available, so the current exploitation probability is unknown, but the vulnerability is listed as not in the CISA KEV catalog. An attacker must have permission to upload ZIP files; with that privilege, the flaw can be leveraged to place and execute PHP code, providing full remote code execution on the affected server. No additional conditions, such as authentication, are required beyond ZIP upload rights.