CVE-2026-81890: elFinder CSRF in netmount allows forced FTP mounts

CVE-2026-81890 · Severity: medium · CVSS 5.4 · Published 2026-08-31

elFinder is a popular open-source PHP file manager library used in web applications to provide file browsing and management functionality. The library implements CSRF protection for most state-changing operations, but fails to protect the network mount feature that allows mounting remote file systems like FTP. An attacker can craft a malicious web page that, when visited by a user with an active elFinder session, silently forces the user's elFinder instance to mount an attacker-controlled FTP server and causes the web server to establish outbound connections to that server, potentially exposing the user's session to man-in-the-middle attacks or facilitating further network reconnaissance.

Technologies: studio-42/elfinder (Packagist), Studio-42 elFinder. Vendors: Packagist, Studio-42.

Quick answers

Is CVE-2026-81890 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81890 being exploited in the wild.
How severe is CVE-2026-81890?
Medium severity, with a CVSS score of 5.4, published 31 August 2026.
Which products and versions are affected?
studio-42/elfinder (Packagist) < 2.1.70, ECOSYSTEM:introduced=0,fixed=2.1.70; Studio-42 elFinder < 2.1.70.
Is there a fix for CVE-2026-81890?
Yes. studio-42/elfinder (Packagist): upgrade to 2.1.70 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81890 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-81890?
Check whether you run studio-42/elfinder (Packagist) or Studio-42 elFinder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • studio-42/elfinder (Packagist): upgrade to 2.1.70 or later
    composer require studio-42/elfinder:^2.1.70

Technical details

The vulnerability is a cross-site request forgery (CSRF) that bypasses elFinder's CSRF token validation. The PHP connector maintains an explicit allowlist of commands requiring CSRF validation (mkdir, mkfile, paste, put, rename, rm, upload, archive, extract, resize, chmod) in `elFinderConnector.class.php:79-92`, but the `netmount` command is omitted from this list. The `netmount` command in `elFinder.class.php:1560-1660` accepts attacker-controlled parameters (protocol, host, port, path, user, pass, alias, options) and executes `netmountPrepare()` followed by `saveNetVolumes()` to persist the mounted volume in the session. The FTP driver implementation in `elFinderVolumeFTP.class.php:264-327` then calls `ftp_connect()`, `ftp_login()`, and FTP commands (FEAT, MLST, CWD, etc.) against the supplied host and port. No authentication is required; the attacker only needs to trigger a request from an authenticated user's browser. The minimal connector shipped with elFinder enables FTP mounts by default (`connector.minimal.php-dist:42-43`), making this the primary attack surface. A proof-of-concept confirmed that a `netmount` request without the CSRF token succeeds with HTTP 200, while an equivalent `mkdir` request without the token correctly fails with HTTP 403.

Affected products

  • Studio-42 elFinder < 2.1.70

Identifiers

  • CVE-2026-81890
  • GHSA-9hjf-w35w-6vx2

Timeline

  • 2026-08-03: disclosed
  • 2026-09-02: advisory
  • 2026-09-02: patched: Version 2.1.70 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.