# CVE-2026-81889: elFinder SSRF protection bypass via DNS rebinding

Source: https://junglewise.ai/threats/cve-2026-81889-elfinder-ssrf-protection-bypass-via-dns-rebinding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81889 · Severity: high · CVSS 8.6 · Published 2026-08-31

elFinder is a popular file manager library used to provide file upload and browsing capabilities in web applications. When cURL is unavailable, elFinder's URL upload feature falls back to socket-based connections that bypass IP address validation, allowing attackers to access internal services on loopback or private networks. An attacker can craft a specially prepared hostname that resolves to different IP addresses on successive DNS lookups—initially returning an allowed public IP to pass validation, then resolving to an internal address during the actual connection. Since responses are saved as uploaded files and readable through elFinder, this enables non-blind disclosure of sensitive internal data.

Technologies: [studio-42/elfinder (Packagist)](https://junglewise.ai/threats/technologies/studio-42-elfinder), [Studio-42 elFinder](https://junglewise.ai/threats/technologies/elfinder). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Studio-42](https://junglewise.ai/threats/vendors/studio-42).

## Quick answers

**Is CVE-2026-81889 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81889 being exploited in the wild.

**How severe is CVE-2026-81889?** High severity, with a CVSS score of 8.6, published 31 August 2026.

**Which products and versions are affected?** studio-42/elfinder (Packagist) <= 2.1.69, ECOSYSTEM:introduced=0,fixed=2.1.70; Studio-42 elFinder <= 2.1.69.

**Is there a fix for CVE-2026-81889?** Yes. studio-42/elfinder (Packagist): upgrade to 2.1.70 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81889 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81889?** Check whether you run studio-42/elfinder (Packagist) or Studio-42 elFinder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- studio-42/elfinder (Packagist): upgrade to 2.1.70 or later

  ```sh
  composer require studio-42/elfinder:^2.1.70
  ```


## Technical details

The vulnerability is a TOCTOU (Time-of-Check-Time-of-Use) flaw in URL upload validation. The validate_address() function resolves a hostname once using gethostbyname(), rejects addresses in loopback or private ranges, and stores the result in $info['ip']. However, the socket fallback (fsock_get_contents()) ignores this validated IP and calls fsockopen() with the original hostname string, triggering a second DNS resolution. An attacker controlling DNS can return a whitelisted public IP on the first lookup (passing validation) and a loopback/private IP on the second (enabling the actual connection to internal services). The cURL code path correctly pins the validated IP using CURLOPT_RESOLVE, but only when the cURL extension is available. Additionally, redirect handling and a subsequent get_headers() call both repeat the hostname resolution without IP pinning. Exploitation requires PHP without cURL, access to URL upload functionality, and network connectivity from the PHP process to the target internal service. A working proof-of-concept demonstrates reading internal secrets by uploading from an attacker-controlled DNS server.

## Affected products

- Studio-42 elFinder <= 2.1.69

## Identifiers

- CVE-2026-81889
- GHSA-8x3q-jpjh-qh5c

## Timeline

- 2026-07-24: disclosed: Initial private report date
- 2026-08-03: patched: Patched in version 2.1.70
- 2026-08-31: advisory: Published to GitHub Advisory Database

## References

- [https://api.github.com/users/Marco198333](https://api.github.com/users/Marco198333)
- [https://github.com/Marco198333](https://github.com/Marco198333)
- [https://api.github.com/users/Marco198333/gists%7B/gist_id%7D](https://api.github.com/users/Marco198333/gists%7B/gist_id%7D)
- [https://api.github.com/users/Marco198333/repos](https://api.github.com/users/Marco198333/repos)
- [https://avatars.githubusercontent.com/u/79453959?v=4](https://avatars.githubusercontent.com/u/79453959?v=4)
- [https://api.github.com/users/Marco198333/events%7B/privacy%7D](https://api.github.com/users/Marco198333/events%7B/privacy%7D)

## Related threats

- [elFinder ZIP extraction MIME filter bypass allowing PHP upload](https://junglewise.ai/threats/cve-2026-81891-elfinder-zip-extraction-mime-filter-bypass-allowing-php-upload)
- [elFinder CSRF in netmount allows forced FTP mounts](https://junglewise.ai/threats/cve-2026-81890-elfinder-csrf-in-netmount-allows-forced-ftp-mounts)
- [Studio-42 elFinder SQL injection in elFinderVolumeMySQL](https://junglewise.ai/threats/cve-2026-44521-studio-42-elfinder-sql-injection-in-elfindervolumemysql)
- [elFinder: Command injection in resize background color parameter when using ImageMagick CLI](https://junglewise.ai/threats/cve-2026-41247-elfinder-command-injection-in-resize-background-color-parameter)
- [Studio 42 elFinder vulnerable to Incorrect Access Control](https://junglewise.ai/threats/cve-2024-38909-studio-42-elfinder-vulnerable-to-incorrect-access-control)