CVE-2026-81890: elFinder CSRF Vulnerability Allows Forced FTP Mounts
Summary
CVE-2026-81890: elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections. Affects studio-42/elfinder versions < 2.1.70. Fixed in 2.1.70. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
elFinder is an open-source file manager for web applications, allowing users to manage files and directories through a web interface. It supports various protocols, including FTP, and is widely used for its ease of integration and user-friendly interface. However, a critical vulnerability has been identified in the PHP connector's handling of cross-site request forgery (CSRF) protections, specifically in the netmount command, which can lead to unauthorized FTP connections.
Vulnerability Detail
The vulnerability arises from the fact that the netmount command in elFinder does not require CSRF validation, unlike other state-changing commands. This oversight allows an attacker to exploit the vulnerability by forcing a victim's elFinder session to mount an attacker-controlled FTP endpoint without the necessary CSRF token. As a result, the server can initiate an outbound FTP connection, potentially exposing sensitive information such as FTP credentials and allowing unauthorized access to the victim's file manager interface.
How To Fix
Minimum fixed version
2.1.70
This is the first release that contains the fix.
composer require studio-42/elfinder:2.1.70Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the FTP netmount feature in your elFinder configuration by commenting out or removing the line that enables it in the connector setup. For example, in your connector.php file, locate the following line and comment it out:
// elFinder::$netDrivers['ftp'] = 'FTP';
Conclusion
CVE-2026-81890 is a significant vulnerability in the elFinder package that allows attackers to exploit CSRF protections, leading to unauthorized FTP connections. It is essential to update to the patched version or implement workarounds to secure your application against potential exploitation.
See every vulnerability recorded for studio-42/elfinder →
FAQ
The impact includes the ability for attackers to force a victim's session to mount an unauthorized FTP endpoint, leading to potential data exposure and unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update, consider disabling the FTP netmount feature as a temporary workaround until you can apply the patch.
Cross-Site Request Forgery (CSRF) is an attack that tricks a user into executing unwanted actions on a web application in which they are authenticated. Proper CSRF protection is crucial to prevent unauthorized actions.
The CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for studio-42/elfinder.
