CVE-2026-81890: elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
The PHP connector’s CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP endpoint in the victim’s session and cause the server to initiate an outbound FTP connection without the X-elFinder-CSRF token that other state-changing commands require.
This was confirmed locally against Studio-42/elFinder at commit ec5f811dc321a053085b994966f553eaaab58721, corresponding to the repository’s documented stable release 2.1.69 / API revision 2.1.69.
References
- github.com/Studio-42/elFinder/commit/31284facd033e081b2b69c08873b39c8a413b762
- github.com/Studio-42/elFinder/commit/36d40fff12222ad4c229d8889d8ed3fd3dbf0415
- github.com/Studio-42/elFinder/releases/tag/2.1.70
- github.com/Studio-42/elFinder/security/advisories/GHSA-9hjf-w35w-6vx2
- github.com/advisories/GHSA-9hjf-w35w-6vx2
- nvd.nist.gov/vuln/detail/CVE-2026-81890
Code Behaviors & Features
Detect and mitigate CVE-2026-81890 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →