CVE-2026-81889

Received Received - Intake

Server-Side Request Forgery in elFinder File Manager

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info['ip'], but get_remote_contents() selects fsock_get_contents(), which connects to $arr['host'] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-81889

Affected Vendors & Products

Vendor	Product	Version / Range
elfinder	elfinder	2.1.70

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

elFinder before 2.1.70 has a vulnerability in URL uploads where server-side request forgery protections can be bypassed. When PHP cURL is unavailable, the system uses fsock_get_contents() which performs DNS resolution twice. An attacker can exploit DNS rebinding to trick the system into connecting to a loopback or private address while the initial DNS resolution returns a public address. This allows the attacker to store internal HTTP responses as uploaded files, making them readable through elFinder.

Impact Analysis

An attacker could exploit this to access sensitive internal data by uploading it as a file in elFinder. This could lead to unauthorized information disclosure, including internal network resources or application data. The vulnerability allows remote attackers to interact with internal systems without direct access.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations, fines, or legal consequences if sensitive data is accessed or leaked due to this issue.

Mitigation Strategies

Upgrade elFinder to version 2.1.70 or later to address the vulnerability. If upgrading is not immediately possible, disable URL uploads in elFinder or restrict access to trusted networks.

Hi! I’m here to help you understand CVE-2026-81889. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70