CVE-2026-81890: elFinder CSRF Vulnerability

CVE-2026-81890 Overview

elFinder is an open-source file manager for web applications, written in JavaScript using jQuery UI. Versions prior to 2.1.70 contain a Cross-Site Request Forgery (CSRF) flaw [CWE-352] in the netmount command. The command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is never invoked for this state-changing operation. An attacker can force a victim's browser to submit a cross-site request that persists an attacker-chosen FTP mount in the victim's session. The issue is fixed in version 2.1.70.

Critical Impact

A cross-site request can cause the PHP server to connect to an attacker-controlled FTP host and port, transmitting supplied credentials without an X-elFinder-CSRF token.

Affected Products

• elFinder versions prior to 2.1.70
• Deployments using the shipped php/connector.minimal.php-dist configuration
• Instances where FTP network mounts are enabled (default)

Discovery Timeline

• 2026-08-31 - CVE-2026-81890 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-81890

Vulnerability Analysis

The vulnerability resides in elFinder's CSRF protection allowlist. The netmount command orchestrates network volume mounts, including FTP, and modifies session state. However, it was never registered in the $csrfProtectedCmds array within php/elFinderConnector.class.php. Because CSRF validation is applied only to commands listed in that array, requests to netmount bypass token verification entirely.

Attacker-controlled parameters, including protocol, host, path, port, user, pass, alias, and additional options, flow through elFinder::netmount() in php/elFinder.class.php and then into php/elFinderVolumeFTP.class.php. This lets an attacker persist an arbitrary FTP mount configuration in the victim's session and coerce the server-side PHP process to initiate outbound FTP connections carrying the supplied credentials.

Root Cause

The root cause is an incomplete CSRF allowlist. State-changing operations must be explicitly enumerated in $csrfProtectedCmds for validateCsrfToken() to execute. The netmount entry was missing, leaving the endpoint reachable via cross-origin requests without an X-elFinder-CSRF header.

Attack Vector

Exploitation requires an authenticated victim to visit or interact with an attacker-controlled page. The malicious page issues a cross-site request to the elFinder connector invoking netmount with attacker-supplied FTP parameters. User interaction is required, but no privileges on the target application are needed by the attacker.

// Patch: php/elFinderConnector.class.php
// Adds 'netmount' to the CSRF-protected commands allowlist
         'extract' => true,
         'mkdir' => true,
         'mkfile' => true,
+        'netmount' => true,
         'paste' => true,
         'put' => true,
         'rename' => true,

Source: elFinder Commit 31284fa

Detection Methods for CVE-2026-81890

Indicators of Compromise

• Unexpected netmount command entries in elFinder connector access logs, particularly requests missing the X-elFinder-CSRF header.
• Outbound FTP connections from the PHP application server to previously unseen hosts or non-standard ports.
• Session storage entries referencing FTP mounts (protocol=ftp) that were not initiated by legitimate user workflows.

Detection Strategies

• Inspect web server logs for POST requests to the elFinder connector where cmd=netmount and the Referer or Origin header does not match the application domain.
• Correlate application-layer requests with egress firewall logs to identify server-initiated FTP sessions triggered by web traffic.
• Review installed elFinder versions across web assets and flag any release earlier than 2.1.70.

Monitoring Recommendations

• Enable auditing of session mutations and alert when new network volume mounts are added to user sessions.
• Monitor egress traffic on TCP/21 and configurable FTP ports from web tiers that should not typically initiate outbound FTP.
• Alert on repeated authentication failures or handshakes to unfamiliar FTP endpoints originating from web server IP ranges.

How to Mitigate CVE-2026-81890

Immediate Actions Required

• Upgrade elFinder to version 2.1.70 or later, which registers netmount in the CSRF-protected commands allowlist.
• Audit active sessions for unauthorized FTP mount entries and invalidate suspicious sessions.
• Restrict outbound FTP connectivity from web application servers to an approved allowlist of destinations.

Patch Information

The fix is available in elFinder Release 2.1.70. Technical details are documented in GitHub Security Advisory GHSA-9hjf-w35w-6vx2 and the corrective change is in commit 31284fa.

Workarounds

• Disable FTP network mounts in php/connector.minimal.php-dist if network volumes are not required.
• Manually add 'netmount' => true to $csrfProtectedCmds in php/elFinderConnector.class.php where immediate upgrade is not possible.
• Enforce SameSite=Strict or SameSite=Lax on the elFinder session cookie to reduce cross-site request exposure.

# Verify installed elFinder version and locate the vulnerable file
grep -R "Version 2.1" ./elFinder/css/elfinder.full.css
find . -name elFinderConnector.class.php -exec grep -H "csrfProtectedCmds" {} \;