Packagist · #1910 most downloaded on Packagist

studio-42/elfinder

2.1.7010.0M downloads/moStudio-42/elFinder ↗New releases in your daily digest, changelog included.

File manager for web

Last release 2 months ago
03 Aug 2026
Release timing varies
gaps range from 2 weeks to 1.6 years
Rarely documented
notes for 5 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
11 years old
78 releases · first in 2015

Release timeline

78 releases since 2015

20152017201920212023

Releases

2.1.703 Aug 2026
Security: Fix CSRF protection for the netmount command
Version 2.1.70

Security: Fix CSRF protection for the netmount command

Security: Fix MIME validation during ZIP archive extraction

Security: Require cURL for URL uploads to prevent SSRF protection bypass in the fsock_get_contents() fallback

Fix postMessage origin bypass and playsound DOM XSS

For technical details of [Security:], please refer to the published GitHub Security Advisories.

Full Changelog: 2.1.69...2.1.70
Open source →
Additional notes
Latest

Latest

Compare

Open source →
2.1.697 May 2026Deprecated
Update deprecated php type casts
Version 2.1.69

Only fixes a release error; there are no changes to the functionality.

Version 2.1.68

Fixing bug where uploading large files sometimes fails (#3761)

Fix incorrect URL generation in getContentUrl() (#3759)

pressing minimized button ( - ) on the editor while the editor is maximized will close the editor (#3737)

Update deprecated php type casts (#3739)

fix(mime): normalize MIME mappings and regenerate elFinder.mimetypes.js

Update Russian translation and authorship details (#3757)

chore(dev): add MIME mapping generator script

Use Array.isArray instead of $.isArray (#3771)

added "SVG image" & "WEBP image" file type description to "Kind" column when in list view (#3738)

Correctly urlencode path in setcookie(); fix #3538 (#3754)

Create SECURITY.md

fix: Pixo Image Editor JS path

update: [css] change font-size of preview

fix: improve PHP 8 compatibility in session, cURL, and callback handling (#3780)

Prepare elFinder for jQuery 4 sup (#3781)

fix: example html, js

build: add elfinder-minimal

feat(editor): add signed callback state storage for external save handlers

fix(connector): add CSRF token validation and refresh flow

fix(connector): refine CSRF token refresh timing and protected commands

fix(js): guard CSRF reload check when xhr is missing

fix(onedrive): prefer cached Graph download URLs for file access

Preserve i18n keys in mount errors

fix:#3782 avoid E_STRICT on PHP 8.4+

Update safe CDN versions for external JS libs

Normalize MPD text/xml MIME type

[i18n:ja] Update elfinder.ja.js

fix(connector): normalize PHP error handling and mount failures

chore(js): update default CDN library versions

chore: ignore local IDE project files

docs: fix correct the incorrect date

[security] [VD:MySQL] normalize numeric object ids for SQL usage

One column per quarter.

2.1.687 May 2026Deprecated

Update deprecated php type casts

Changes form previous version

Full Changelog: 2.1.67...2.1.68

Fixing bug where uploading large files sometimes fails (#3761)
Fix incorrect URL generation in getContentUrl() (#3759)
pressing minimized button ( - ) on the editor while the editor is maximized will close the editor (#3737)
Update deprecated php type casts (#3739)
fix(mime): normalize MIME mappings and regenerate elFinder.mimetypes.js
Update Russian translation and authorship details (#3757)
chore(dev): add MIME mapping generator script
Use Array.isArray instead of $.isArray (#3771)
added "SVG image" & "WEBP image" file type description to "Kind" column when in list view (#3738)
Correctly urlencode path in setcookie(); fix #3538 (#3754)
Create SECURITY.md
fix: Pixo Image Editor JS path
update: [css] change font-size of preview
fix: improve PHP 8 compatibility in session, cURL, and callback handling (#3780)
Prepare elFinder for jQuery 4 sup (#3781)
fix: example html, js
build: add elfinder-minimal
feat(editor): add signed callback state storage for external save handlers
fix(connector): add CSRF token validation and refresh flow
fix(connector): refine CSRF token refresh timing and protected commands
fix(js): guard CSRF reload check when xhr is missing
fix(onedrive): prefer cached Graph download URLs for file access
Preserve i18n keys in mount errors
fix:#3782 avoid E_STRICT on PHP 8.4+
Update safe CDN versions for external JS libs
Normalize MPD text/xml MIME type
[i18n:ja] Update elfinder.ja.js
fix(connector): normalize PHP error handling and mount failures
chore(js): update default CDN library versions
chore: ignore local IDE project files
docs: fix correct the incorrect date
[security] [VD:MySQL] normalize numeric object ids for SQL usage

Open source →

2.1.6717 Apr 2026Security

[security] fix command injection vulnerability in resize background color handling when using the ImageMagick CLI backend

Changes form previous version

Full Changelog: 2.1.66...2.1.67

[security] fix command injection vulnerability in resize background color handling when using the ImageMagick CLI backend

Open source →

2.1.6628 Aug 2025Deprecated

[PHP 8.4] Fix: Curl CURLOPT_BINARYTRANSFER deprecated

Changes form previous version

Full Changelog: 2.1.64...2.1.66

Version 2.1.65

[js] update CDNs
[php:editors] Zoho API update