diff --git a/php/elFinder.class.php b/php/elFinder.class.php
index 763b9a9bd..689cda149 100644
--- a/php/elFinder.class.php
+++ b/php/elFinder.class.php
@@ -4090,10 +4090,14 @@ class elFinder
         $x = (int)$args['x'];
         $y = (int)$args['y'];
         $mode = $args['mode'];
-        $bg = $args['bg'];
+        $bg = isset($args['bg']) ? trim((string)$args['bg']) : '';
         $degree = (int)$args['degree'];
         $quality = (int)$args['quality'];
 
+        if ($bg !== '' && !$this->isSafeBgColor($bg)) {
+            return array('error' => $this->error(self::ERROR_RESIZE, self::ERROR_INV_PARAMS));
+        }
+
         if (($volume = $this->volume($target)) == false
             || ($file = $volume->file($target)) == false) {
             return array('error' => $this->error(self::ERROR_RESIZE, '#' . $target, self::ERROR_FILE_NOT_FOUND));
@@ -4107,6 +4111,40 @@ class elFinder
             : array('error' => $this->error(self::ERROR_RESIZE, $volume->path($target), $volume->error()));
     }
 
+    /**
+     * Validate background color for image operations.
+     *
+     * Allowed formats:
+     * - transparent
+     * - #RGB
+     * - #RRGGBB
+     * - #RRGGBBAA
+     * - rgb(r,g,b)
+     * - rgba(r,g,b,a)
+     *
+     * @param string $bg
+     * @return bool
+     */
+    protected function isSafeBgColor($bg) {
+        if ($bg === 'transparent') {
+            return true;
+        }
+
+        if (preg_match('/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/', $bg)) {
+            return true;
+        }
+
+        if (preg_match('/^rgb\(\s*(?:25[0-5]|2[0-4]\d|1?\d?\d)\s*,\s*(?:25[0-5]|2[0-4]\d|1?\d?\d)\s*,\s*(?:25[0-5]|2[0-4]\d|1?\d?\d)\s*\)$/', $bg)) {
+            return true;
+        }
+
+        if (preg_match('/^rgba\(\s*(?:25[0-5]|2[0-4]\d|1?\d?\d)\s*,\s*(?:25[0-5]|2[0-4]\d|1?\d?\d)\s*,\s*(?:25[0-5]|2[0-4]\d|1?\d?\d)\s*,\s*(?:0|0?\.\d+|1(?:\.0+)?)\s*\)$/', $bg)) {
+            return true;
+        }
+
+        return false;
+    }
+
     /**
      * Return content URL
      *
diff --git a/php/elFinderVolumeDriver.class.php b/php/elFinderVolumeDriver.class.php
index 7df8d253b..237501b69 100644
--- a/php/elFinderVolumeDriver.class.php
+++ b/php/elFinderVolumeDriver.class.php
@@ -6170,7 +6170,22 @@ abstract class elFinderVolumeDriver
                 if ($bgcolor === 'transparent') {
                     $bgcolor = 'rgba(255, 255, 255, 0.0)';
                 }
-                $cmd = sprintf('%s -size %dx%d "xc:%s" png:- | convert%s%s%s png:-  %s -geometry +%d+%d -compose over -composite%s %s', ELFINDER_CONVERT_PATH, $width, $height, $bgcolor, $coalesce, $jpgQuality, $interlace, $quotedPath, $x, $y, $deconstruct, $quotedDstPath);
+                $bgArg = escapeshellarg('xc:' . $bgcolor);
+                $cmd = sprintf(
+                    '%s -size %dx%d %s png:- | convert%s%s%s png:- %s -geometry +%d+%d -compose over -composite%s %s',
+                    ELFINDER_CONVERT_PATH,
+                    $width,
+                    $height,
+                    $bgArg,
+                    $coalesce,
+                    $jpgQuality,
+                    $interlace,
+                    $quotedPath,
+                    $x,
+                    $y,
+                    $deconstruct,
+                    $quotedDstPath
+                );
 
                 $result = false;
                 if ($this->procExec($cmd) === 0) {
@@ -6310,7 +6325,19 @@ abstract class elFinderVolumeDriver
                 if ($s[2] === IMAGETYPE_GIF || $s[2] === IMAGETYPE_PNG) {
                     $bgcolor = 'rgba(255, 255, 255, 0.0)';
                 }
-                $cmd = sprintf('%s%s%s%s -background "%s" -rotate %d%s -- %s %s', ELFINDER_CONVERT_PATH, $coalesce, $jpgQuality, $interlace, $bgcolor, $degree, $deconstruct, $quotedPath, $quotedDstPath);
+                $bgArg = escapeshellarg($bgcolor);
+                $cmd = sprintf(
+                    '%s%s%s%s -background %s -rotate %d%s -- %s %s',
+                    ELFINDER_CONVERT_PATH,
+                    $coalesce,
+                    $jpgQuality,
+                    $interlace,
+                    $bgArg,
+                    $degree,
+                    $deconstruct,
+                    $quotedPath,
+                    $quotedDstPath
+                );
 
                 $result = false;
                 if ($this->procExec($cmd) === 0) {