CVE-2026-81890 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
Attackers can force victims to mount malicious FTP servers, causing the application to connect to attacker-controlled hosts and leak credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-81890?
CVE-2026-81890 is a medium-severity vulnerability in Studio-42 elFinder, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.
Weakness: CWE-352
Which versions are affected by CVE-2026-81890?
2 open source packages ship an affected version, including studio-42/elfinder.
| Package | Affected | Fixed in |
|---|---|---|
studio-42/elfinder Packagist | All versions | 2.1.70 |
studio-42/elfinder Packagist | All versions | 2.1.70 |
How do I fix CVE-2026-81890?
Upgrade studio-42/elfinder to 2.1.70 or later.
Is CVE-2026-81890 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81890 exists.
Sources
Also known as GHSA-9hjf-w35w-6vx2.