GHSA-8X3Q-JPJH-QH5C elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

poc.zip Summary elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery SSRF protection bypass when PHP cURL is unavailable and URL uploads use the fsockgetcontents fallback. An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially...

CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

EUVD-2026-68768

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-81889

elFinder (open-source web file manager) contains an SSRF protection bypass in php/elFinder.class.php prior to version 2.1.70 . When PHP cURL is unavailable, get_remote_contents() falls back to fsock_get_contents(), which performs a second DNS resolution to $arr['host'] independent of the IP alrea...

CVE-2026-81890: Cross-Site Request Forgery (CSRF)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

PT-2026-84020

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description URL uploads in php/elFinder.class.php can bypass server-side request forgery SSRF protections when PHP cURL is unavailable. The validate address function validates the IP address, but get remote...

PT-2026-84021

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description The netmount command is missing from the elFinderConnector::$csrfProtectedCmds list in php/elFinderConnector.class.php, which prevents the validateCsrfToken function from being executed during this...

PT-2026-84022

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description The checkExtractItems function in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Due to the absence of .phtml, .phar, .php5, a...

CVE-2026-81891: Unrestricted Upload of File with Dangerous Type

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...

CVE-2026-81889: Server-Side Request Forgery (SSRF)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

EUVD-2026-53703

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

PT-2026-68372

Name of the Vulnerable Software and Affected Versions File Manager for WordPress versions 6.0 through 6.9 Description Insufficient file path validation in the connector function allows authenticated attackers with subscriber-level access and above to read and delete arbitrary files on the server...

CVE-2026-6382

Several WordPress plugins—FileOrganizer (before 1.1.9), Advanced File Manager (before 5.4.12), File Manager Pro (before 2.1.1), and File Manager (before 8.0.4)—are vulnerable to OS Command Injection . The root cause is the improper escaping of a parameter before it is passed to a shell command du...

CVE-2026-6382 Multiple elFinder Plugins - Authenticated OS Command Injection

The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operation...

CVE-2026-11962 FileOrganizer < 1.2.0 - Authenticated Arbitrary File Upload via elFinder File Operations

The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and...

CVE-2026-11962 FileOrganizer < 1.2.0 - Authenticated Arbitrary File Upload via elFinder File Operations

The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and...

CVE-2026-11962

The FileOrganizer WordPress plugin, in versions prior to 1.2.0 , fails to validate file types during various file-management operations. This vulnerability allows authenticated users with file-manager permissions—which may include sub-administrator roles via the premium add-on—to upload arbitrary...

📄 Xerte Online Toolkits 3.15 Unauthenticated Remote Code Execution

Python remote code execution proof of concept exploit for Xerte Online Toolkits targeting multiple vulnerabilities in the elFinder file manager integration. ================================================================================================================================== | Title :...