CVE-2026-81890: elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
elFinderto a version that resolves this vulnerability.Fixed in 2.1.70 - Compensating control
Disable FTP network mounts (FTP mounts are enabled by default in the shipped php/connector.minimal.php-dist configuration) so attacker-controlled netmount parameters cannot persist in the victim session or trigger server-side FTP connections.
Event History
Frequently Asked Questions
Which deployments are exposed by default?
The shipped php/connector.minimal.php-dist configuration enables FTP network mounts by default. Deployments using that configuration are exposed if they run a version earlier than 2.1.70.
What must an attacker do to exploit this issue?
An attacker needs to cause a victim to make a cross-site request to the vulnerable netmount operation; no X-elFinder-CSRF token is required. The request can supply the FTP protocol, host, port, path, credentials, alias, and options.
What is the practical impact of a successful exploit?
The attacker can create a persistent FTP mount in the victim's session and make the PHP server initiate an FTP connection to an attacker-selected host and port. Any credentials supplied in the request can be sent to that FTP server.
What can be done if an upgrade is not immediately possible?
Disable FTP network mounts where possible, since the vulnerable operation is the netmount command used for FTP mounts. Upgrade to elFinder 2.1.70 when available to restore CSRF validation for this state-changing operation.