CVE-2026-81889

[poc.zip](https://github.com/user-attachments/files/30352020/poc.zip) ## Summary elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass when PHP cURL is unavailable and URL uploads use the `fsock_get_contents()` fallback. An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially resolves to an allowed public IP address and subsequently resolves to a loopback or private IP address. The URL validation checks the first resolved IP, but `fsock_get_contents()` opens the actual connection using the original hostname. This causes a second DNS resolution and allows the connection to reach an address different from the one that was validated. The response from the internal service is saved as an uploaded file and can be read through elFinder. This makes the demonstrated issue a non-blind SSRF. The most accurate classification is: * Vulnerability: SSRF protection bypass * Exploitation technique: DNS rebinding * Root cause: TOCTOU/double DNS resolution without IP pinning ## Affected versions Confirmed affected: * elFinder 2.1.69, commit `8f2c3ffafcdd52cf4515f1eec172f4eee44552ad` * the current `master` branch inspected on 24 July 2026 The earliest affected version has not been determined. ## Preconditions The demonstrated readback path requires: * PHP without the cURL extension (`curl_exec()` unavailable); * access to the URL upload functionality; * permission to upload a MIME type returned by the target service; * network connectivity from the PHP process to the internal target; * DNS resolution behavior compatible with low or zero TTL responses. Authentication requirements depend on the application integrating the elFinder connector. The attached reproduction connector is intentionally minimal and unauthenticated. ## Technical details `validate_address()` resolves the supplied hostname with `gethostbyname()`, rejects loopback and private ranges, and stores the accepted a