CVE-2026-81889
HighCVSS 8.6Summary
In elFinder before version 2.1.70, there is a Server-Side Request Forgery (SSRF) vulnerability during URL uploads. When PHP cURL is unavailable, IP validation can be bypassed via DNS rebinding, allowing connections to internal addresses. Additionally, even when using cURL, there is a blind SSRF path. The issue is fixed in version 2.1.70.
Risk Assessment
An attacker can access internal network resources or read responses from internal servers, potentially leading to data leakage or further attacks.
Recommendation
Update elFinder to version 2.1.70 or later which includes a fix for this vulnerability.
Other vulnerabilities in elFinder
See all- CVE-2026-81891High
In elFinder (a web file manager) before version 2.1.70, there is a vulnerability that allows bypassing file type restrictions during archive extraction. The checkExtractItems() function does not normalize the MIME type, so files with extensions .phtml, .phar, .php5, and .php3 can be extracted even if uploadDeny blocks text/x-php. An attacker with ZIP upload permission can place PHP files in a web-accessible directory and achieve remote code execution. The issue is fixed in version 2.1.70.
- CVE-2026-81890Medium
elFinder before version 2.1.70 does not protect the netmount command against CSRF attacks because it is not included in the list of protected commands. In the default configuration, FTP network mounts are enabled, and an attacker can control parameters such as protocol, host, port, user, password, allowing persistent mounting of an attacker-chosen FTP server in the victim's session and sending credentials without a CSRF token.
- CVE-2024-38909Critical
Studio 42 elFinder version 2.1.64 is vulnerable to incorrect access control. Copying files with an unauthorized extension between server directories allows an attacker to expose secrets and perform remote code execution (RCE).
Original NVD description (English source)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info['ip'], but get_remote_contents() selects fsock_get_contents(), which connects to $arr['host'] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70.