SSRF Protection Bypass in elFinder via DNS Rebinding

elFinder version 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) bypass when the PHP cURL extension is unavailable. In this scenario, elFinder falls back to using fsock_get_contents() for URL uploads. While the application performs an initial hostname validation to block private and loopback IP addresses, it fails to pin the validated IP address for the subsequent socket connection.

An attacker can exploit this by using DNS rebinding: the hostname resolves to a benign public IP address during the validation phase, but resolves to a private or loopback address when fsock_get_contents() initiates the actual connection. This allows an attacker to bypass security checks and force the server to issue HTTP GET requests to internal network endpoints. The response from these internal services is then saved as a file by elFinder, enabling sensitive information disclosure. This vulnerability, identified as CVE-2026-81889, represents a significant risk for deployments where PHP cURL is not active.

Attack Chain

1. The attacker prepares a malicious DNS server configured to perform DNS rebinding, returning a public IP during the first resolution and an internal/loopback IP during subsequent requests.
2. The attacker submits a URL pointing to the malicious hostname through the elFinder upload interface.
3. The elFinder validate_address() function resolves the hostname, receives the benign public IP, and confirms it is not in a restricted range.
4. Due to the lack of cURL, the application proceeds to the fsock_get_contents() fallback mechanism.
5. The fallback mechanism initiates a new connection to the original hostname, triggering a second DNS resolution.
6. The DNS server returns the internal or loopback IP address, and the server establishes a connection to the internal service.
7. The internal service processes the request and returns data to the elFinder instance.
8. elFinder saves the internal service response as a file, which the attacker then reads via the file management interface.

Impact

Successful exploitation allows for the disclosure of sensitive information from internal services, loopback interfaces, or private network segments reachable from the server. This can lead to the compromise of internal administrative endpoints or application data. Given the potential for unauthenticated access, the impact is rated as High, with a CVSS 3.1 score of 8.6.

Recommendation

Prioritized actions for security teams:

• Verify if elFinder is deployed in environments where PHP cURL is unavailable.
• Prioritize upgrading elFinder to a patched version once released by the vendor.
• Implement a temporary workaround by configuring urlUploadFilter to restrict or disable URL-based uploads if they are not business-critical.
• Audit network logs for unusual outbound connections initiated by the web server process to private or loopback IP ranges.