CVE-2026-81889 is a server-side request forgery (SSRF) vulnerability in elFinder, an open-source web file manager. Prior to version 2.1.70, the URL upload feature in php/elFinder.class.php could bypass SSRF protections via DNS rebinding when PHP cURL is unavailable. The validate_address() function validates the IP from the first DNS resolution, but fsock_get_contents() performs a second DNS resolution connecting to the hostname, allowing attackers to redirect connections to loopback or private addresses. Additionally, get_headers() makes a separate request to the original hostname without reusing the validated connection, creating a secondary blind SSRF path even when cURL is in use. Successful exploitation allows internal HTTP response bodies to be stored as uploaded files and accessed through elFinder. The vulnerability has been patched in elFinder version 2.1.70, with fixes available via two separate commits on GitHub.
