CVE-2026-81889

elFinder, an open-source web-based file manager, does not fully enforce its server-side request forgery (SSRF) protections for URL uploads before version 2.1.70: when PHP cURL is unavailable, validate_address() checks the IP from an initial DNS resolution, but fsock_get_contents() then connects using the hostname and performs a second, independent DNS lookup. An attacker who can submit a URL upload can exploit DNS rebinding so the first lookup returns a public address while the connection lookup returns a loopback or private address, causing the server to fetch an internal resource and store its HTTP response body as an uploaded file that the attacker can then read through elFinder. Independently, get_headers($url, true) re-requests the original hostname without reusing the validated and pinned connection, creating an additional blind SSRF path that applies even when the cURL code path is selected. Any deployment running the elFinder PHP backend prior to 2.1.70 with URL uploads enabled is affected, including standalone installations and applications that embed elFinder. There is currently no known exploitation, no public proof-of-concept, and the flaw is not in CISA's KEV catalog, with EPSS estimating a 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade elFinder to version 2.1.70 or later. As interim mitigations, ensure the PHP cURL extension is installed so the vulnerable fsockopen path is not used, restrict URL-upload functionality to trusted users, and apply network controls that prevent the web server from reaching loopback or internal/private network services. Check your elFinder configuration to confirm whether URL uploads are enabled and whether any untrusted users can reach them.