Executive brief
elFinder is a popular open-source PHP file manager library used in web applications to provide file browsing and management functionality. The library implements CSRF protection for most state-changing operations, but fails to protect the network mount feature that allows mounting remote file systems like FTP. An attacker can craft a malicious web page that, when visited by a user with an active elFinder session, silently forces the user's elFinder instance to mount an attacker-controlled FTP server and causes the web server to establish outbound connections to that server, potentially exposing the user's session to man-in-the-middle attacks or facilitating further network reconnaissance.
Technical details
The vulnerability is a cross-site request forgery (CSRF) that bypasses elFinder's CSRF token validation. The PHP connector maintains an explicit allowlist of commands requiring CSRF validation (mkdir, mkfile, paste, put, rename, rm, upload, archive, extract, resize, chmod) in `elFinderConnector.class.php:79-92`, but the `netmount` command is omitted from this list. The `netmount` command in `elFinder.class.php:1560-1660` accepts attacker-controlled parameters (protocol, host, port, path, user, pass, alias, options) and executes `netmountPrepare()` followed by `saveNetVolumes()` to persist the mounted volume in the session. The FTP driver implementation in `elFinderVolumeFTP.class.php:264-327` then calls `ftp_connect()`, `ftp_login()`, and FTP commands (FEAT, MLST, CWD, etc.) against the supplied host and port. No authentication is required; the attacker only needs to trigger a request from an authenticated user's browser. The minimal connector shipped with elFinder enables FTP mounts by default (`connector.minimal.php-dist:42-43`), making this the primary attack surface. A proof-of-concept confirmed that a `netmount` request without the CSRF token succeeds with HTTP 200, while an equivalent `mkdir` request without the token correctly fails with HTTP 403.
Affected products
- Studio-42 elFinder < 2.1.70
Timeline
- 2026-08-03: disclosed
- 2026-09-02: advisory
- 2026-09-02: patched: Version 2.1.70 released with fix