Security Concern: cmd GET Parameter Usage in elFinder

[sjsage522]

Hello,

I noticed that the elFinder project uses the cmd GET parameter to handle various operations. However, according to OWASP’s list of top 25 risky parameters, the cmd parameter is considered a security risk, as it is commonly exploited in command injection attacks.

In our company, we enforce strict security policies that block the use of high-risk parameters, including cmd. As a result, integrating elFinder into our system presents a challenge.

Would you consider providing an alternative to the cmd parameter, such as a different naming convention or a more secure approach to handling commands?

Looking forward to your thoughts.

Best regards