CVE-2026-81890

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.

Summary

The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP endpoint in the victim's session and cause the server to initiate an outbound FTP connection without the X-elFinder-CSRF token that other state-changing commands require.

This was confirmed locally against Studio-42/elFinder at commit ec5f811dc321a053085b994966f553eaaab58721, corresponding to the repository's documented stable release 2.1.69 / API revision 2.1.69.

Details

The connector has an explicit allowlist of commands that require CSRF validation in php/elFinderConnector.class.php:79-92. That list includes state-changing commands such as mkdir, mkfile, paste, put, rename, rm, upload, archive, extract, resize, and chmod, but it omits netmount. The enforcement point in php/elFinderConnector.class.php:376-381 calls validateCsrfToken() only when the command appears in that list.

netmount is a first-class connector command declared in php/elFinder.class.php:248-278, specifically php/elFinder.class.php:263, with attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments. Its implementation in php/elFinder.class.php:1560-1660 resolves the requested network driver, copies request arguments into a volume options array, calls the driver's netmountPrepare(), mounts the volume online, and persists successful network volume options in the session with saveNetVolumes() at php/elFinder.class.php:1642-1649.

The documented minimal installation path tells users to rename /php/connector.minimal.php-dist and load elFinder (README.md:105-120). That shipped minimal connector explicitly enables FTP network mounts at php/connector.minimal.php-dist:42-43:

// // Enable FTP connector netmount
elFinder::$netDrivers['ftp'] = 'FTP';

The FTP driver then uses request-controlled connection parameters. php/elFinderVolumeFTP.class.php:164-215 initializes the host, port, user, password, path, and netmount key, and php/elFinderVolumeFTP.class.php:264-327 calls ftp_connect() / ftp_ssl_connect(), ftp_login(), ftp_raw(), ftp_chdir(), ftp_pwd(), ftp_pasv(), FEAT, and MLST against the supplied endpoint. The local proof showed those FTP commands reaching a fake local FTP server.

False-positive checks performed:

• mkdir without the CSRF header was rejected with HTTP 403 and csrfReload:true, proving the harness exercised the connector's CSRF gate.
• netmount without the same CSRF header succeeded with HTTP 200 and an added network-volume response.
• The fake FTP server observed an inbound connection and FTP command sequence from the PHP process.
• No custom application authentication, external service, public infrastructure, or destructive action was used.
• Sibling netmount drivers were reviewed; FTP is the relevant default/common exposure because the minimal connector enables it, while SFTP/cloud drivers require extra configuration or credentials.

Candidate score: 16/18 under the audit rubric. Reachability 2, attacker control 2, privilege required 2, sink impact 2, mitigation weakness 2, default exposure 2, safe reproduction 2, static certainty 2, false-positive resistance 2. The exploitability gate is satisfied for this issue as a confirmed CSRF/state-change and server-side FTP connection primitive in the shipped minimal connector configuration.

PoC

The following safe local reproduction uses only a disposable connector under /tmp, the repository's PHP classes, PHP's built-in local web server, and a fake FTP listener bound to 127.0.0.1. It does not contact external systems.

1. From a clean checkout of Studio-42/elFinder at commit ec5f811dc321a053085b994966f553eaaab58721, create a disposable…

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.

Summary

The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP endpoint in the victim's session and cause the server to initiate an outbound FTP connection without the X-elFinder-CSRF token that other state-changing commands require.

This was confirmed locally against Studio-42/elFinder at commit ec5f811dc321a053085b994966f553eaaab58721, corresponding to the repository's documented stable release 2.1.69 / API revision 2.1.69.

Details

The connector has an explicit allowlist of commands that require CSRF validation in php/elFinderConnector.class.php:79-92. That list includes state-changing commands such as mkdir, mkfile, paste, put, rename, rm, upload, archive, extract, resize, and chmod, but it omits netmount. The enforcement point in php/elFinderConnector.class.php:376-381 calls validateCsrfToken() only when the command appears in that list.

netmount is a first-class connector command declared in php/elFinder.class.php:248-278, specifically php/elFinder.class.php:263, with attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments. Its implementation in php/elFinder.class.php:1560-1660 resolves the requested network driver, copies request arguments into a volume options array, calls the driver's netmountPrepare(), mounts the volume online, and persists successful network volume options in the session with saveNetVolumes() at php/elFinder.class.php:1642-1649.

The documented minimal installation path tells users to rename /php/connector.minimal.php-dist and load elFinder (README.md:105-120). That shipped minimal connector explicitly enables FTP network mounts at php/connector.minimal.php-dist:42-43:

// // Enable FTP connector netmount
elFinder::$netDrivers['ftp'] = 'FTP';

The FTP driver then uses request-controlled connection parameters. php/elFinderVolumeFTP.class.php:164-215 initializes the host, port, user, password, path, and netmount key, and php/elFinderVolumeFTP.class.php:264-327 calls ftp_connect() / ftp_ssl_connect(), ftp_login(), ftp_raw(), ftp_chdir(), ftp_pwd(), ftp_pasv(), FEAT, and MLST against the supplied endpoint. The local proof showed those FTP commands reaching a fake local FTP server.

False-positive checks performed:

• mkdir without the CSRF header was rejected with HTTP 403 and csrfReload:true, proving the harness exercised the connector's CSRF gate.
• netmount without the same CSRF header succeeded with HTTP 200 and an added network-volume response.
• The fake FTP server observed an inbound connection and FTP command sequence from the PHP process.
• No custom application authentication, external service, public infrastructure, or destructive action was used.
• Sibling netmount drivers were reviewed; FTP is the relevant default/common exposure because the minimal connector enables it, while SFTP/cloud drivers require extra configuration or credentials.

Candidate score: 16/18 under the audit rubric. Reachability 2, attacker control 2, privilege required 2, sink impact 2, mitigation weakness 2, default exposure 2, safe reproduction 2, static certainty 2, false-positive resistance 2. The exploitability gate is satisfied for this issue as a confirmed CSRF/state-change and server-side FTP connection primitive in the shipped minimal connector configuration.

PoC

The following safe local reproduction uses only a disposable connector under /tmp, the repository's PHP classes, PHP's built-in local web server, and a fake FTP listener bound to 127.0.0.1. It does not contact external systems.

1. From a clean checkout of Studio-42/elFinder at commit ec5f811dc321a053085b994966f553eaaab58721, create a disposable…