CVE-2026-81889: elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass when PHP cURL is unavailable and URL uploads use the fsock_get_contents() fallback.
An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially resolves to an allowed public IP address and subsequently resolves to a loopback or private IP address.
The URL validation checks the first resolved IP, but fsock_get_contents() opens the actual connection using the original hostname. This causes a second DNS resolution and allows the connection to reach an address different from the one that was validated.
The response from the internal service is saved as an uploaded file and can be read through elFinder. This makes the demonstrated issue a non-blind SSRF.
The most accurate classification is:
- Vulnerability: SSRF protection bypass
- Exploitation technique: DNS rebinding
- Root cause: TOCTOU/double DNS resolution without IP pinning
References
- github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff
- github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51
- github.com/Studio-42/elFinder/releases/tag/2.1.70
- github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c
- github.com/advisories/GHSA-8x3q-jpjh-qh5c
- nvd.nist.gov/vuln/detail/CVE-2026-81889
Code Behaviors & Features
Detect and mitigate CVE-2026-81889 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →