Description

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-31T21:17:52.603Z",
  "pubdate": "2026-08-31T21:17:52.603Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability exists in elFinder prior to version 2.1.70, originating from an incomplete implementation of the CSRF protection mechanism.\nThe vulnerability allows an unauthenticated or remote attacker to force a victim's session to perform a state-changing operation by omitting the 'netmount' command from the csrfProtectedCmds array in php/elFinderConnector.class.php.\nThis oversight results in the bypass of the validateCsrfToken() function for the netmount command, enabling unauthorized actors to mount attacker-controlled FTP volumes within the victim's elFinder instance.\nThe impact is severe, as it facilitates unauthorized connections to external FTP servers, potentially leading to sensitive data exfiltration, credential harvesting, or further exploitation of the server-side infrastructure.\nSuccessful exploitation requires the victim to have an active session with the vulnerable elFinder application while the attacker triggers a crafted request, typically achieved via social engineering or malicious web content.\nGiven that FTP network mounts are enabled by default in the standard configuration (php/connector.minimal.php-dist), the attack surface is significant for any deployment using the default settings.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper security configuration of the elFinder connector's command validation logic. Specifically, the 'netmount' command is missing from the $csrfProtectedCmds array defined in php/elFinderConnector.class.php. Consequently, the application fails to invoke the validateCsrfToken() method when a netmount command is submitted to the connector.\nThe vulnerability propagates through the application architecture starting from the elFinderConnector class, which routes incoming requests to the relevant command handlers. Because netmount is excluded from CSRF protection, the server processes the request without verifying the presence or validity of an X-elFinder-CSRF token.\nIn the attack flow, an attacker constructs a malicious cross-site request targeting the victim's elFinder endpoint. This request includes parameters for protocol, host, path, port, user, pass, alias, and options. Since the server does not enforce CSRF validation for the netmount action, these parameters are accepted by the php/elFinder::netmount() function located in php/elFinder.class.php.\nThe flow continues as the elFinder::netmount() function processes these parameters and propagates them to the php/elFinderVolumeFTP.class.php component. This component initiates a connection to the attacker-supplied FTP host and port, utilizing the provided credentials. Because the application processes this request within the context of the authenticated user's session, the server-side infrastructure is effectively coerced into connecting to an arbitrary, attacker-controlled resource.\nAffected versions include all versions of elFinder prior to 2.1.70. The exploitation does not require the attacker to possess prior authentication to the application, as the vulnerability resides in the handling of the CSRF token validation process itself. The post-exploitation impact includes the persistence of the malicious mount within the user's session, which may allow the attacker to browse, manipulate, or exfiltrate file structures accessible through the elFinder interface, or to leverage the server as a proxy for further network-based attacks against internal or external infrastructure."
}