elFinder, an open-source web file manager written in JavaScript using jQuery UI, contains an authenticated SQL injection vulnerability in versions prior to 2.1.68. The vulnerability exists in the MySQL volume driver (elFinderVolumeMySQL) and allows any logged-in user, including those with read-only access, to inject SQL commands through a crafted target file hash. Successful exploitation can lead to unauthorized data disclosure and denial of service. The vulnerability only affects installations configured to use the MySQL volume driver and has been fixed in version 2.1.68.