CVE-2026-81889: CWE-918: Server-Side Request Forgery (SSRF) in Studio-42 elFinder

elFinder versions prior to 2.1.70 contain an SSRF vulnerability in the URL upload feature implemented in php/elFinder.class.php. When PHP cURL is unavailable, the function validate_address() validates the IP address from the first DNS resolution, but the actual connection uses fsock_get_contents(), which performs a second DNS resolution. This discrepancy allows an attacker to use DNS rebinding to have the first resolution return a public IP and the second resolution return a private or loopback IP, causing internal HTTP responses to be fetched and stored as uploaded files accessible via elFinder. Furthermore, after fetching content, get_headers() makes an additional request to the original hostname without reusing the validated connection, creating another SSRF vector even when cURL is used. This vulnerability is addressed in elFinder version 2.1.70.

Successful exploitation allows an unauthenticated attacker to perform SSRF attacks via the URL upload feature, potentially accessing internal network resources or sensitive data by causing the server to fetch internal HTTP responses and store them as files accessible through elFinder. The vulnerability does not impact integrity or availability but can lead to significant confidentiality breaches.

This vulnerability is fixed in elFinder version 2.1.70. Users should upgrade to version 2.1.70 or later to remediate this issue. No official patch or temporary workaround details are provided in the available data. Until upgraded, disabling URL upload functionality or ensuring PHP cURL is available and properly configured may reduce risk, but the definitive fix is upgrading to 2.1.70.