CVE-2026-81889

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70

Description URL uploads in php/elFinder.class.php can bypass server-side request forgery (SSRF) protections when PHP cURL is unavailable. The validate address() function validates the IP address, but get remote contents() uses fsock get contents(), which connects to the host variable and performs a second DNS resolution. This creates a Time-of-Check to Time-of-Use (TOCTOU) condition where an attacker can use DNS rebinding to provide a public address during validation and a loopback or private address during the actual connection. This allows the internal HTTP response body to be stored as an uploaded file and read through elFinder. Additionally, the use of get headers() separately requests the original hostname without reusing the validated connection, creating a blind SSRF path. DNS rebinding is a technique where a DNS server changes the IP address associated with a hostname between the time it is validated and the time it is used.

Recommendations Update to version 2.1.70. As a temporary mitigation, reject URL uploads when cURL is unavailable or configure urlUploadFilter to reject URL uploads.