GHSA-9HJF-W35W-6VX2 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...

CVE-2026-78410

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

CVE-2026-76642

When an external mount. helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode...

PT-2026-84766

Name of the Vulnerable Software and Affected Versions util-linux affected versions not specified Description A flaw exists where restricted bind mounts retrieve the source path from fstab without pinning the source before the privileged mount occurs. This allows a local unprivileged user who can...

PT-2026-84982

Name of the Vulnerable Software and Affected Versions util-linux versions prior to 2.41.6 util-linux version 2.42.2 Description The software fails to verify the exit status of mount helpers before executing post-mount hooks. This allows unprivileged users to perform privileged operations on...

PT-2026-84765

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 6.15 and later Description An issue exists where the X-mount.subdir option utilizes a detached-tree fast path and passes the configured subdirectory to the open tree function using the AT SYMLINK NOFOLLOW flag. This flag...

CVE-2026-78410: Time-of-check Time-of-use (TOCTOU) Race Condition

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

Linux Distros Unpatched Vulnerability : CVE-2026-78410

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local...

CVE-2026-84267

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...

CVE-2026-84268

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

UBUNTU-CVE-2026-84269

A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operati...

SUSE CVE-2026-72379

In the Linux kernel, the following vulnerability has been resolved: fs: refuse OTMPFILE creation with an unmapped fsuid or fsgid vfstmpfile never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fsu,gid, the -tmpfi...

CVE-2026-81890

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

CVE-2026-81890 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

CVE-2026-81890 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

CVE-2026-81890 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

CVE-2026-81890

elFinder (an open-source web file manager built on jQuery UI) prior to 2.1.70 is vulnerable to a CSRF flaw in the netmount command. The command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is never invoked for this state-changing...

Important: udisks2

Issue Overview: Local privilege escalation via as-user mount spoofing NOTE: https://github.com/azqzazq1/CVE-2026-7867-disk2root CVE-2026-7867 Affected Packages: udisks2 Issue Correction: Run dnf update udisks2 --releasever 2023.12.20260831 or dnf update --advisory ALAS2023-2026-2104 --releasever...

PT-2026-84021

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description The netmount command is missing from the elFinderConnector::$csrfProtectedCmds list in php/elFinderConnector.class.php, which prevents the validateCsrfToken function from being executed during this...