Vulnerability-Lookup

CVE-2026-81889 (GCVE-0-2026-81889)

Vulnerability from cvelistv5 – Published: 2026-08-31 20:25 – Updated: 2026-09-03 18:04

Title

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

Summary

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info['ip'], but get_remote_contents() selects fsock_get_contents(), which connects to $arr['host'] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 18:04 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/Studio-42/elFinder/security/ad…	x_refsource_CONFIRM
https://github.com/Studio-42/elFinder/commit/1913…	x_refsource_MISC
https://github.com/Studio-42/elFinder/commit/6d99…	x_refsource_MISC
https://github.com/Studio-42/elFinder/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Studio-42	elFinder	Affected: < 2.1.70	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81889",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T18:04:00.867870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T18:04:09.418Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "elFinder",
          "vendor": "Studio-42",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.70"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info[\u0027ip\u0027], but get_remote_contents() selects fsock_get_contents(), which connects to $arr[\u0027host\u0027] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T20:25:27.456Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c"
        },
        {
          "name": "https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff"
        },
        {
          "name": "https://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51"
        },
        {
          "name": "https://github.com/Studio-42/elFinder/releases/tag/2.1.70",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Studio-42/elFinder/releases/tag/2.1.70"
        }
      ],
      "source": {
        "advisory": "GHSA-8x3q-jpjh-qh5c",
        "discovery": "UNKNOWN"
      },
      "title": "elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-81889",
    "datePublished": "2026-08-31T20:25:27.456Z",
    "dateReserved": "2026-08-27T17:48:42.123Z",
    "dateUpdated": "2026-09-03T18:04:09.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-81889",
      "date": "2026-09-22",
      "epss": "0.00334",
      "percentile": "0.26889"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "elFinder",
                "vendor": "Studio-42",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.1.70"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info[\u0027ip\u0027], but get_remote_contents() selects fsock_get_contents(), which connects to $arr[\u0027host\u0027] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70."
          }
        ],
        "id": "CVE-2026-81889",
        "lastModified": "2026-09-09T21:09:13.080",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-81889",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T18:04:00.867870Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-31T21:17:52.460",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Studio-42/elFinder/releases/tag/2.1.70"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-81889",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-03T18:04:00.867870Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-03T18:03:42.847Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "elFinder",
              "vendor": "Studio-42",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.1.70"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info[\u0027ip\u0027], but get_remote_contents() selects fsock_get_contents(), which connects to $arr[\u0027host\u0027] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-31T20:25:27.456Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c"
            },
            {
              "name": "https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff"
            },
            {
              "name": "https://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51"
            },
            {
              "name": "https://github.com/Studio-42/elFinder/releases/tag/2.1.70",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Studio-42/elFinder/releases/tag/2.1.70"
            }
          ],
          "source": {
            "advisory": "GHSA-8x3q-jpjh-qh5c",
            "discovery": "UNKNOWN"
          },
          "title": "elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-81889",
        "datePublished": "2026-08-31T20:25:27.456Z",
        "dateReserved": "2026-08-27T17:48:42.123Z",
        "dateUpdated": "2026-09-03T18:04:09.418Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2026-13684 (CVE-2026-81889)

Vulnerability from fstec – Published: 2026-09-02 – Updated: 2026-09-02 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимость функции fsock_get_contents() файлового менеджера elFinder, позволяющая нарушителю раскрыть защищаемую информацию

Summary

Уязвимость функции fsock_get_contents() файлового менеджера elFinder связана с недостаточной проверкой запросов на стороне сервера. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, раскрыть защищаемую информацию

Severity

7.8 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:N/A:N

8.6 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Spoofing

Incidents

Being clarified

Remediation

Software update

CWE

CWE-918 - Серверная фальсификация запросов

Aliases

CVE-2026-81889

References

4 references

URL
https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff
https://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51
https://github.com/Studio-42/elFinder/releases/tag/2.1.70
https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c

Impacted products

1 product from 1 vendor

Vendors

Сообщество свободного программного обеспечения

Products

elFinder

Versions

до 2.1.70 (elFinder)

Product types

Application software

Mitigations

Использование рекомендаций производителя: https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 2.1.70 (elFinder)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "03.08.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "02.09.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "02.09.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-13684",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-81889",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "elFinder",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 fsock_get_contents() \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0433\u043e \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 elFinder, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0421\u0435\u0440\u0432\u0435\u0440\u043d\u0430\u044f \u0444\u0430\u043b\u044c\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 (CWE-918)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 fsock_get_contents() \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0433\u043e \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 elFinder \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff\nhttps://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51\nhttps://github.com/Studio-42/elFinder/releases/tag/2.1.70\nhttps://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-918",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,6)"
}

FKIE_CVE-2026-81889

Vulnerability from fkie_nvd - Published: 2026-08-31 21:17 - Updated: 2026-09-09 21:09

Severity

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff
	security-advisories@github.com	https://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51
	security-advisories@github.com	https://github.com/Studio-42/elFinder/releases/tag/2.1.70
	security-advisories@github.com	https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "elFinder",
          "vendor": "Studio-42",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.70"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info[\u0027ip\u0027], but get_remote_contents() selects fsock_get_contents(), which connects to $arr[\u0027host\u0027] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70."
    }
  ],
  "id": "CVE-2026-81889",
  "lastModified": "2026-09-09T21:09:13.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-81889",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-03T18:04:00.867870Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-31T21:17:52.460",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Studio-42/elFinder/releases/tag/2.1.70"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8X3Q-JPJH-QH5C

Vulnerability from github – Published: 2026-08-31 20:28 – Updated: 2026-08-31 20:28

Summary

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

Details

poc.zip

Summary

elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass when PHP cURL is unavailable and URL uploads use the fsock_get_contents() fallback.

An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially resolves to an allowed public IP address and subsequently resolves to a loopback or private IP address.

The URL validation checks the first resolved IP, but fsock_get_contents() opens the actual connection using the original hostname. This causes a second DNS resolution and allows the connection to reach an address different from the one that was validated.

The response from the internal service is saved as an uploaded file and can be read through elFinder. This makes the demonstrated issue a non-blind SSRF.

The most accurate classification is:

Vulnerability: SSRF protection bypass
Exploitation technique: DNS rebinding
Root cause: TOCTOU/double DNS resolution without IP pinning

Affected versions

Confirmed affected:

elFinder 2.1.69, commit 8f2c3ffafcdd52cf4515f1eec172f4eee44552ad
the current master branch inspected on 24 July 2026

The earliest affected version has not been determined.

Preconditions

The demonstrated readback path requires:

PHP without the cURL extension (curl_exec() unavailable);
access to the URL upload functionality;
permission to upload a MIME type returned by the target service;
network connectivity from the PHP process to the internal target;
DNS resolution behavior compatible with low or zero TTL responses.

Authentication requirements depend on the application integrating the elFinder connector. The attached reproduction connector is intentionally minimal and unauthenticated.

Technical details

validate_address() resolves the supplied hostname with gethostbyname(), rejects loopback and private ranges, and stores the accepted address in $info['ip']:

https://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2587-L2655

get_remote_contents() then selects cURL when available, otherwise fsock_get_contents():

https://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2673-L2689

The cURL implementation correctly pins the validated IP using CURLOPT_RESOLVE:

https://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2709-L2736

However, the socket fallback ignores $info['ip'] and connects using $arr['host']:

$fp = fsockopen(
    $ssl . $arr['host'],
    $arr['port'],
    $errno,
    $errstr,
    $connect_timeout
);

Relevant code:

https://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2762-L2866

Consequently, the address checked by validate_address() is not necessarily the address used by the socket connection.

The same problem is present after redirects: the redirect URL is validated, but the recursive socket request again connects using the hostname rather than the validated IP.

Proof of concept

A Docker-based reproduction is attached as poc.zip.

The laboratory:

downloads the official elFinder 2.1.69 release during the build;
verifies that the package version is 2.1.69;
verifies that curl_exec() is unavailable;
does not modify the elFinder core;
runs a deterministic DNS server and an HTTP service bound only to loopback.

Build and run:

docker build -t elfinder-ssrf-repro poc
docker run --rm -p 127.0.0.1:8081:8081 elfinder-ssrf-repro

Open:

http://127.0.0.1:8081/poc/index.html

In the elFinder interface:

Select "Upload".
Paste the following URL:

http://rebind.test:9001/secret.txt

Wait for the upload to complete.
Open the resulting secret.txt file.

Observed content:

INTERNAL_SECRET_MANUAL

The PoC DNS server responds as follows:

first A resolution       -> 203.0.113.10
subsequent A resolutions -> 127.0.0.1

Expected logs include:

DNS rebind.test type=1 answer=203.0.113.10 count=1
DNS rebind.test type=1 answer=127.0.0.1 count=2
GET /secret.txt

203.0.113.10 is used only as a deterministic laboratory address that passes the current private-address checks. The actual connection reaches 127.0.0.1:9001.

A redirect variant is also included:

http://rebind.test:9001/redirect-secret

It produces the same readable internal content.

Security impact

An attacker may cause the elFinder server to issue HTTP GET requests to services reachable from the PHP process, including:

loopback services;
private network services;
link-local services where reachable;
internal administrative or application endpoints.

Because the response body is saved and exposed through elFinder, sensitive internal information may be disclosed.

The demonstrated primitive is limited to HTTP GET requests and does not provide arbitrary request methods, bodies, or headers. Integrity and availability impact would depend on the behavior of reachable internal endpoints and are not claimed by this PoC.

Suggested CVSS

For an exposed connector matching the attached PoC:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Base score: 8.6 High.

This assumes:

no authentication is required by the connector;
the internal service represents a separate security scope;
disclosure may include highly sensitive internal data.

If authenticated user access is considered an inherent prerequisite, PR:L would result in a score of 7.7 High.

Suggested remediation

The socket connection should use the IP address returned by validate_address() rather than resolving the hostname again.

For HTTPS, the original hostname should still be used for:

the HTTP Host header;
TLS SNI;
certificate hostname validation.

This may require replacing fsockopen() with a connection mechanism that supports connecting to the validated IP while explicitly configuring the TLS peer name.

Every redirect destination should be independently validated and its validated IP pinned to that specific connection.

Revalidating the hostname immediately before connecting is not sufficient because it would still leave a validation-to-connection DNS resolution gap.

As a temporary mitigation, URL uploads could be rejected when cURL is unavailable, or deployments could configure urlUploadFilter to reject URL uploads.

Additional observation

After a successful URL fetch, the upload path calls:

get_headers($url, true)

Relevant code:

https://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L3356-L3374

This performs another request using the original hostname without reusing the validated and pinned connection. It may therefore introduce an additional blind SSRF request, potentially even when the cURL download path is selected.

This additional request is not required for the attached non-blind fsock_get_contents() PoC. It should nevertheless be reviewed during remediation. Ideally, filename and response-header information should be collected from the already validated HTTP response instead of issuing a separate request.

Disclosure

Initial private report date: 24/07/2026

Reporter contact: Marco Lunardi - marcolunardi90@gmail.com

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.1.69"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "studio-42/elfinder"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.70"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-81889"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-31T20:28:06Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "[poc.zip](https://github.com/user-attachments/files/30352020/poc.zip)\n## Summary\n\nelFinder 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass when PHP cURL is unavailable and URL uploads use the `fsock_get_contents()` fallback.\n\nAn attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially resolves to an allowed public IP address and subsequently resolves to a loopback or private IP address.\n\nThe URL validation checks the first resolved IP, but `fsock_get_contents()` opens the actual connection using the original hostname. This causes a second DNS resolution and allows the connection to reach an address different from the one that was validated.\n\nThe response from the internal service is saved as an uploaded file and can be read through elFinder. This makes the demonstrated issue a non-blind SSRF.\n\nThe most accurate classification is:\n\n* Vulnerability: SSRF protection bypass \n* Exploitation technique: DNS rebinding\n* Root cause: TOCTOU/double DNS resolution without IP pinning\n\n## Affected versions\n\nConfirmed affected:\n\n* elFinder 2.1.69, commit `8f2c3ffafcdd52cf4515f1eec172f4eee44552ad`\n* the current `master` branch inspected on 24 July 2026\n\nThe earliest affected version has not been determined.\n\n## Preconditions\n\nThe demonstrated readback path requires:\n\n* PHP without the cURL extension (`curl_exec()` unavailable);\n* access to the URL upload functionality;\n* permission to upload a MIME type returned by the target service;\n* network connectivity from the PHP process to the internal target;\n* DNS resolution behavior compatible with low or zero TTL responses.\n\nAuthentication requirements depend on the application integrating the elFinder connector. The attached reproduction connector is intentionally minimal and unauthenticated.\n\n## Technical details\n\n`validate_address()` resolves the supplied hostname with `gethostbyname()`, rejects loopback and private ranges, and stores the accepted address in `$info[\u0027ip\u0027]`:\n\nhttps://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2587-L2655\n\n`get_remote_contents()` then selects cURL when available, otherwise `fsock_get_contents()`:\n\nhttps://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2673-L2689\n\nThe cURL implementation correctly pins the validated IP using `CURLOPT_RESOLVE`:\n\nhttps://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2709-L2736\n\nHowever, the socket fallback ignores `$info[\u0027ip\u0027]` and connects using `$arr[\u0027host\u0027]`:\n\n```php\n$fp = fsockopen(\n    $ssl . $arr[\u0027host\u0027],\n    $arr[\u0027port\u0027],\n    $errno,\n    $errstr,\n    $connect_timeout\n);\n```\n\nRelevant code:\n\nhttps://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2762-L2866\n\nConsequently, the address checked by `validate_address()` is not necessarily the address used by the socket connection.\n\nThe same problem is present after redirects: the redirect URL is validated, but the recursive socket request again connects using the hostname rather than the validated IP.\n\n## Proof of concept\n\nA Docker-based reproduction is attached as `poc.zip`.\n\nThe laboratory:\n\n* downloads the official elFinder 2.1.69 release during the build;\n* verifies that the package version is 2.1.69;\n* verifies that `curl_exec()` is unavailable;\n* does not modify the elFinder core;\n* runs a deterministic DNS server and an HTTP service bound only to loopback.\n\nBuild and run:\n\n```sh\ndocker build -t elfinder-ssrf-repro poc\ndocker run --rm -p 127.0.0.1:8081:8081 elfinder-ssrf-repro\n```\n\nOpen:\n\n```text\nhttp://127.0.0.1:8081/poc/index.html\n```\n\nIn the elFinder interface:\n\n1. Select \"Upload\".\n2. Paste the following URL:\n\n```text\nhttp://rebind.test:9001/secret.txt\n```\n\n3. Wait for the upload to complete.\n4. Open the resulting `secret.txt` file.\n\nObserved content:\n\n```text\nINTERNAL_SECRET_MANUAL\n```\n\nThe PoC DNS server responds as follows:\n\n```text\nfirst A resolution       -\u003e 203.0.113.10\nsubsequent A resolutions -\u003e 127.0.0.1\n```\n\nExpected logs include:\n\n```text\nDNS rebind.test type=1 answer=203.0.113.10 count=1\nDNS rebind.test type=1 answer=127.0.0.1 count=2\nGET /secret.txt\n```\n\n`203.0.113.10` is used only as a deterministic laboratory address that passes the current private-address checks. The actual connection reaches `127.0.0.1:9001`.\n\nA redirect variant is also included:\n\n```text\nhttp://rebind.test:9001/redirect-secret\n```\n\nIt produces the same readable internal content.\n\n## Security impact\n\nAn attacker may cause the elFinder server to issue HTTP GET requests to services reachable from the PHP process, including:\n\n* loopback services;\n* private network services;\n* link-local services where reachable;\n* internal administrative or application endpoints.\n\nBecause the response body is saved and exposed through elFinder, sensitive internal information may be disclosed.\n\nThe demonstrated primitive is limited to HTTP GET requests and does not provide arbitrary request methods, bodies, or headers. Integrity and availability impact would depend on the behavior of reachable internal endpoints and are not claimed by this PoC.\n\n## Suggested CVSS\n\nFor an exposed connector matching the attached PoC:\n\n```text\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n```\n\nBase score: 8.6 High.\n\nThis assumes:\n\n* no authentication is required by the connector;\n* the internal service represents a separate security scope;\n* disclosure may include highly sensitive internal data.\n\nIf authenticated user access is considered an inherent prerequisite, `PR:L` would result in a score of 7.7 High.\n\n## Suggested remediation\n\nThe socket connection should use the IP address returned by `validate_address()` rather than resolving the hostname again.\n\nFor HTTPS, the original hostname should still be used for:\n\n* the HTTP `Host` header;\n* TLS SNI;\n* certificate hostname validation.\n\nThis may require replacing `fsockopen()` with a connection mechanism that supports connecting to the validated IP while explicitly configuring the TLS peer name.\n\nEvery redirect destination should be independently validated and its validated IP pinned to that specific connection.\n\nRevalidating the hostname immediately before connecting is not sufficient because it would still leave a validation-to-connection DNS resolution gap.\n\nAs a temporary mitigation, URL uploads could be rejected when cURL is unavailable, or deployments could configure `urlUploadFilter` to reject URL uploads.\n\n## Additional observation\n\nAfter a successful URL fetch, the upload path calls:\n\n```php\nget_headers($url, true)\n```\n\nRelevant code:\n\nhttps://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L3356-L3374\n\nThis performs another request using the original hostname without reusing the validated and pinned connection. It may therefore introduce an additional blind SSRF request, potentially even when the cURL download path is selected.\n\nThis additional request is not required for the attached non-blind `fsock_get_contents()` PoC. It should nevertheless be reviewed during remediation. Ideally, filename and response-header information should be collected from the already validated HTTP response instead of issuing a separate request.\n\n## Disclosure\n\nInitial private report date: `24/07/2026`\n\nReporter contact: `Marco Lunardi - marcolunardi90@gmail.com`",
  "id": "GHSA-8x3q-jpjh-qh5c",
  "modified": "2026-08-31T20:28:06Z",
  "published": "2026-08-31T20:28:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Studio-42/elFinder"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Studio-42/elFinder/releases/tag/2.1.70"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-81889 (GCVE-0-2026-81889)

BDU:2026-13684 (CVE-2026-81889)

FKIE_CVE-2026-81889

GHSA-8X3Q-JPJH-QH5C

Summary

Affected versions

Preconditions

Technical details

Proof of concept

Security impact

Suggested CVSS

Suggested remediation

Additional observation

Disclosure

Tags

Sightings

Nomenclature

Related by attack behaviour