CVE-2026-81890: CWE-352: Cross-Site Request Forgery (CSRF) in Studio-42 elFinder

elFinder is a JavaScript-based web file manager. Before version 2.1.70, the netmount command was omitted from the list of CSRF-protected commands in the PHP connector, allowing state-changing operations without CSRF token validation. The default minimal PHP connector configuration enables FTP network mounts, and attacker-controlled parameters can be passed to the netmount function, causing the server to connect to an attacker-chosen FTP host and port with supplied credentials without requiring a valid CSRF token. This vulnerability allows an attacker to persist an FTP mount in the victim's session via a cross-site request. The vulnerability is addressed in elFinder version 2.1.70.

An attacker can exploit this vulnerability to perform unauthorized FTP mounts in a victim's session by sending a crafted cross-site request. This can cause the server to connect to attacker-controlled FTP servers using attacker-supplied credentials, potentially leading to unauthorized access or data exposure related to the FTP mount. The impact is limited to confidentiality and integrity with no direct availability impact.

This vulnerability is fixed in elFinder version 2.1.70. Users should upgrade to version 2.1.70 or later to ensure the netmount command is protected by CSRF token validation. No official patch or temporary fix details are provided beyond this version update. Until upgrading, users should consider disabling FTP network mounts or applying custom CSRF protections if feasible.