# CVE-2021-32682: Multiple vulnerabilities leading to RCE

- Exploited (CISA KEV): no
- Published: 2021-06-14
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 69.9% (99th percentile)
- CWE: CWE-918, CWE-22, CWE-78

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2024-05-21 | 1072 |
| Akamai | No public source | — | — |
| OWASP CRS | Before feed history | — | — |

### F5

- 2024-05-21 · new · rule 200103403
  > Added: signature 200103403 "elFinder Remote Command Execution" (Command Execution, risk High), systems: PHP. References: CVE-2021-32682.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2026-09-16 · new · rule 200013215
  > Added: signature 200013215 "elFinder Broken Access Control" (Authentication/Authorization Attacks, risk High), systems: PHP. References: CVE-2021-43421, CVE-2021-32682.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 9 requests blocked), template CVE-2021-32682, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: passed (0 of 9 requests blocked), template CVE-2021-32682, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2021-32682 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2021-32682