elFinder CVE-2026-81890

The victim must have an active authenticated session to an elFinder instance and must visit a page under the attacker's control while that session is live - the standard CSRF precondition. The elFinder deployment must use the default connector.minimal.php-dist configuration with FTP network mounts enabled; if FTP mounts have been explicitly disabled or the connector is customized to exclude elFinderVolumeFTP, the SSRF component is not reachable. Exploitation is limited to pre-2.1.70 versions; the attacker requires no account or privileges on the elFinder instance itself. Deployments that have removed netmount support entirely from their connector are not exploitable via this path.

The CVSS 5.4 Medium score reflects the CSRF pattern accurately: network-reachable, low complexity, no attacker privileges, but gated on victim interaction and delivering only partial impact. The real-world risk is moderately elevated beyond what the raw score conveys, for two reasons. First, the unauthorized FTP mount persists in the victim's PHP session, meaning subsequent file-manager operations by the victim can traverse the attacker-controlled mount point. Second, the server-side FTP connection to an attacker-chosen host and port constitutes an SSRF primitive - the PHP server probes internal or external endpoints on the attacker's behalf, potentially exposing internal network topology or bypassing perimeter controls. No EPSS data was supplied, so exploitation probability cannot be quantified; the vulnerability is not in CISA KEV, confirming no known active exploitation at time of analysis. Deployments that have disabled FTP mounts in their connector configuration are not exposed to the SSRF component, which significantly reduces risk for those environments.

An attacker hosts a web page containing an auto-submitting form or fetch() call targeting the victim's elFinder connector with a netmount command specifying an attacker-controlled FTP server (e.g., ftp://attacker.example:2121). When an authenticated elFinder user visits the page, their browser sends the request with valid session cookies but no CSRF token, which the server accepts; the PHP process then initiates an FTP connection to the attacker's host, and the malicious mount is persisted in the victim's session for further file-system manipulation. No public proof-of-concept exploit has been identified, but the attack is straightforward to implement given the public advisory and commit diff.