{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3astudio-42elfinder/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:studio-42:elfinder:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-81889"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["elFinder (\u003c= 2.1.69)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Studio-42"],"content_html":"\u003cp\u003eelFinder version 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) bypass when the PHP cURL extension is unavailable. In this scenario, elFinder falls back to using \u003ccode\u003efsock_get_contents()\u003c/code\u003e for URL uploads. While the application performs an initial hostname validation to block private and loopback IP addresses, it fails to pin the validated IP address for the subsequent socket connection.\u003c/p\u003e\n\u003cp\u003eAn attacker can exploit this by using DNS rebinding: the hostname resolves to a benign public IP address during the validation phase, but resolves to a private or loopback address when \u003ccode\u003efsock_get_contents()\u003c/code\u003e initiates the actual connection. This allows an attacker to bypass security checks and force the server to issue HTTP GET requests to internal network endpoints. The response from these internal services is then saved as a file by elFinder, enabling sensitive information disclosure. This vulnerability, identified as CVE-2026-81889, represents a significant risk for deployments where PHP cURL is not active.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker prepares a malicious DNS server configured to perform DNS rebinding, returning a public IP during the first resolution and an internal/loopback IP during subsequent requests.\u003c/li\u003e\n\u003cli\u003eThe attacker submits a URL pointing to the malicious hostname through the elFinder upload interface.\u003c/li\u003e\n\u003cli\u003eThe elFinder \u003ccode\u003evalidate_address()\u003c/code\u003e function resolves the hostname, receives the benign public IP, and confirms it is not in a restricted range.\u003c/li\u003e\n\u003cli\u003eDue to the lack of cURL, the application proceeds to the \u003ccode\u003efsock_get_contents()\u003c/code\u003e fallback mechanism.\u003c/li\u003e\n\u003cli\u003eThe fallback mechanism initiates a new connection to the original hostname, triggering a second DNS resolution.\u003c/li\u003e\n\u003cli\u003eThe DNS server returns the internal or loopback IP address, and the server establishes a connection to the internal service.\u003c/li\u003e\n\u003cli\u003eThe internal service processes the request and returns data to the elFinder instance.\u003c/li\u003e\n\u003cli\u003eelFinder saves the internal service response as a file, which the attacker then reads via the file management interface.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the disclosure of sensitive information from internal services, loopback interfaces, or private network segments reachable from the server. This can lead to the compromise of internal administrative endpoints or application data. Given the potential for unauthenticated access, the impact is rated as High, with a CVSS 3.1 score of 8.6.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVerify if elFinder is deployed in environments where PHP cURL is unavailable.\u003c/li\u003e\n\u003cli\u003ePrioritize upgrading elFinder to a patched version once released by the vendor.\u003c/li\u003e\n\u003cli\u003eImplement a temporary workaround by configuring \u003ccode\u003eurlUploadFilter\u003c/code\u003e to restrict or disable URL-based uploads if they are not business-critical.\u003c/li\u003e\n\u003cli\u003eAudit network logs for unusual outbound connections initiated by the web server process to private or loopback IP ranges.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-31T23:58:45Z","date_published":"2026-08-31T23:58:45Z","id":"https://feed.craftedsignal.io/briefs/2026-08-elfinder-ssrf/","summary":"elFinder 2.1.69 and earlier are vulnerable to a DNS rebinding SSRF attack when PHP cURL is unavailable, allowing attackers to access internal or loopback network services.","title":"SSRF Protection Bypass in elFinder via DNS Rebinding","url":"https://feed.craftedsignal.io/briefs/2026-08-elfinder-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:studio-42:elfinder:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}