DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-81889: CVE-2026-81889: Server-Side Request Forgery via DNS Rebinding in elFinder

#security #cve #cybersecurity

CVE-2026-81889: Server-Side Request Forgery via DNS Rebinding in elFinder

Vulnerability ID: CVE-2026-81889
CVSS Score: 8.6
Published: 2026-08-31

An in-depth analysis of CVE-2026-81889, a critical Server-Side Request Forgery (SSRF) vulnerability in the remote URL upload component of elFinder web file manager before version 2.1.70. The flaw leverages DNS rebinding due to insecure socket fallbacks when the PHP cURL extension is missing, resulting in access to internal network resources and local loopback services.

TL;DR

A TOCTOU flaw in elFinder's remote URL upload mechanism allows attackers to perform DNS rebinding and bypass IP validations, leading to SSRF and exfiltration of internal/metadata services.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network
  • CVSS Score: 8.6 (High)
  • Exploit Status: Proof-of-Concept
  • Impact: Confidentiality (High)
  • Scope Change: Changed (S:C)

Affected Systems

  • elFinder
  • elFinder: < 2.1.70 (Fixed in: 2.1.70)

Code Analysis

Commit: 6d99738

Core SSRF and DNS Rebinding fix. Removes fsock fallback, mandates curl, and implements inline header parsing.

Commit: 191372c

Merge and final integrations for security hardening in remote contents retrieval.

Mitigation Strategies

  • Enforce PHP cURL extension usage and disable standard PHP socket fallbacks.
  • Implement strict outbound egress controls to prevent connection attempts to internal RFC 1918 networks and cloud metadata service endpoints.

Remediation Steps:

  1. Identify the elFinder version deployed in the web directory.
  2. Upgrade elFinder to version 2.1.70 or newer.
  3. Verify that the PHP cURL extension is installed and enabled (e.g., via phpinfo() or php -m).
  4. Configure web server or host egress firewalls to block outbound requests to 127.0.0.0/8 and 169.254.169.254.

References

Read the full report for CVE-2026-81889 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)