CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
Attackers can bypass SSRF protections via DNS rebinding to read internal network resources through elFinder's URL upload feature.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81889?
CVE-2026-81889 is a high-severity server-side request forgery vulnerability in Studio-42 elFinder, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info['ip'], but get_remote_contents() selects fsock_get_contents(), which connects to $arr['host'] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70.
Weakness: CWE-918
Which versions are affected by CVE-2026-81889?
2 open source packages ship an affected version, including studio-42/elfinder.
| Package | Affected | Fixed in |
|---|---|---|
studio-42/elfinder Packagist | All versions | 2.1.70 |
studio-42/elfinder Packagist | All versions | 2.1.70 |
How do I fix CVE-2026-81889?
Upgrade studio-42/elfinder to 2.1.70 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-81889 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81889 exists.
Sources
Also known as GHSA-8x3q-jpjh-qh5c.