# elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

elFinder's ZIP extract path skips mimeTypeNormalize, so .phtml/.phar files bypass uploadDeny text/x-php and land executable in files/, yielding RCE.

- Payout: Research
- Severity: high
- Program: elFinder
- Found by: jdh5202
- Disclosed: 2026-09-02
- CVE: CVE-2026-81891
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-gxmj-r5rf-ggwq
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-gxmj-r5rf-ggwq
- Tags: area:web domain:web impact:rce kind:research platform:ghsa sev:high tech:php technique:incomplete-fix technique:source-review vuln:file-upload vuln:rce

**Target:** elFinder PHP connector (extract command / checkExtractItems)
**Root cause:** checkExtractItems() calls mimetypeInternalDetect() directly without mimeTypeNormalize(), so extensions absent from mime.types (phtml, phar, php5, php3) never resolve to text/x-php and evade the uploadDeny filter.
**Steps:**
1. Confirm direct upload of `hello.phtml` (`<?php phpinfo(); ?>`) is rejected: "File type not allowed (text/x-php)".
2. Create `bypass.zip` containing `hello.phtml` and upload it; accepted as `application/zip` in uploadAllow.
3. Right-click the ZIP and choose Extract files; `hello.phtml` is written to the files/ directory without error.
4. Request `http://<target>/elFinder/files/hello.phtml`; Apache executes it and phpinfo() renders, confirming RCE.
**How found:** Compared the MIME validation pipeline of the upload command (mimetypeInternalDetect + mimeTypeNormalize + allowPutMime) against the shortened pipeline in checkExtractItems(), noticing stage 2 was missing and that phtml/phar are absent from mime.types.
**Exploitation:** Attacker with ZIP upload permission uploads an archive containing a .phtml payload, extracts it via the elFinder UI into the web-served files/ directory, then requests the extracted file to execute arbitrary PHP (phpinfo() shown; swap for a web shell).
**Escalation:** Replace phpinfo() with `<?php system($_GET['cmd']); ?>` for a full web shell, enabling filesystem access, credential theft and internal network pivoting.
**Insight:** When a codebase has a canonical validation pipeline, grep for every call site of its first stage alone — secondary paths (extract, rename, copy, archive) often skip normalization steps, and extensions missing from mime.types are the tell.