CVE-2026-81890

Received Received - Intake

CSRF Bypass in elFinder File Manager

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-81890

Affected Vendors & Products

Vendor	Product	Version / Range
elnfinder	elfinder	2.1.70

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects elFinder, a web-based file manager. In versions before 2.1.70, the netmount command lacks CSRF protection, allowing attackers to mount unauthorized FTP servers in a victim's session without a valid CSRF token.

Detection Guidance

Check if your elFinder version is below 2.1.70 by running commands like 'composer show elfinder/elfinder' or checking the version in the installed files. Look for unexpected FTP mounts in the elFinder session or logs that indicate unauthorized network connections.

Impact Analysis

An attacker could exploit this to trick you into mounting a malicious FTP server, potentially stealing credentials or accessing sensitive files stored on the server. The attack requires user interaction but can be executed via a crafted cross-site request.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) by exposing confidential information through compromised FTP mounts.

Mitigation Strategies

Upgrade elFinder to version 2.1.70 or later immediately. If upgrading is not possible, disable the netmount feature by removing or commenting out the relevant code in php/elFinderConnector.class.php and php/connector.minimal.php-dist.

Hi! I’m here to help you understand CVE-2026-81890. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70