CVE-2026-81889: elFinder SSRF Protection Bypass via DNS Rebinding
Summary
CVE-2026-81889: elFinder: SSRF protection bypass via DNS rebinding in the fsock_get_contents() fallback. Affects studio-42/elfinder versions < 2.1.70. Fixed in 2.1.70. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
elFinder is an open-source file manager for web applications that allows users to manage files and directories on a server. It provides a user-friendly interface and supports various file operations, including uploads, downloads, and file editing. The vulnerability in question affects elFinder version 2.1.69, where a Server-Side Request Forgery (SSRF) protection bypass can occur when PHP cURL is unavailable, allowing attackers to exploit the URL upload functionality.
Vulnerability Detail
The vulnerability arises from a flaw in the way elFinder validates URLs for server-side uploads. When the cURL extension is not available, elFinder uses the 'fsock_get_contents()' function as a fallback. An attacker can submit a URL that initially resolves to an allowed public IP address but later resolves to a loopback or private IP address due to DNS rebinding. The validation checks only the first resolved IP, allowing the connection to reach an unauthorized address. This results in a non-blind SSRF, where sensitive internal information may be disclosed through the uploaded file.
How To Fix
Minimum fixed version
2.1.70
This is the first release that contains the fix.
composer require studio-42/elfinder:2.1.70Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can reject URL uploads when the cURL extension is unavailable. Additionally, you can configure the 'urlUploadFilter' to restrict URL uploads until the package is updated.
Conclusion
In summary, CVE-2026-81889 is a critical vulnerability in elFinder that allows for SSRF protection bypass through DNS rebinding. It is essential to update to the patched version 2.1.70 or later to secure your application. Additionally, implementing the suggested workarounds can help mitigate risks until an update can be performed.
See every vulnerability recorded for studio-42/elfinder →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive data.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
If exploited, this vulnerability can lead to the disclosure of sensitive internal information, as the attacker can make the server request internal services that should not be accessible.
Yes, you can temporarily mitigate the issue by rejecting URL uploads when cURL is unavailable and configuring the 'urlUploadFilter' to restrict URL uploads.
The CVSS score for this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for studio-42/elfinder.
