CVE-2026-81890

### Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the `netmount` connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP endpoint in the victim's session and cause the server to initiate an outbound FTP connection without the `X-elFinder-CSRF` token that other state-changing commands require. This was confirmed locally against `Studio-42/elFinder` at commit `ec5f811dc321a053085b994966f553eaaab58721`, corresponding to the repository's documented stable release `2.1.69` / API revision `2.1.69`. ### Details The connector has an explicit allowlist of commands that require CSRF validation in `php/elFinderConnector.class.php:79-92`. That list includes state-changing commands such as `mkdir`, `mkfile`, `paste`, `put`, `rename`, `rm`, `upload`, `archive`, `extract`, `resize`, and `chmod`, but it omits `netmount`. The enforcement point in `php/elFinderConnector.class.php:376-381` calls `validateCsrfToken()` only when the command appears in that list. `netmount` is a first-class connector command declared in `php/elFinder.class.php:248-278`, specifically `php/elFinder.class.php:263`, with attacker-controlled `protocol`, `host`, `path`, `port`, `user`, `pass`, `alias`, and `options` arguments. Its implementation in `php/elFinder.class.php:1560-1660` resolves the requested network driver, copies request arguments into a volume options array, calls the driver's `netmountPrepare()`, mounts the volume online, and persists successful network volume options in the session with `saveNetVolumes()` at `php/elFinder.class.php:1642-1649`. The documented minimal installation path tells users to rename `/php/connector.minimal.php-dist` and load elFinder (`README.md:105-120`). That shipped minimal connector explicitly enables FTP network mounts at `php/connector.minimal.php-dist:42-43`: ```php // // Enable