Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-81890, is a Cross-Site Request Forgery (CSRF) issue in elFinder's netmount command. The core problem is that the netmount command was not included in the $csrfProtectedCmds array within php/elFinderConnector.class.php. This omission meant that the validateCsrfToken() function was not invoked when the netmount command was executed.
The elFinderConnector::run method is the primary entry point for processing commands in elFinder. It is responsible for dispatching commands and enforcing security checks, including CSRF validation based on the $csrfProtectedCmds array. In the vulnerable state, when a request for the netmount command arrived, elFinderConnector::run would fail to perform the necessary CSRF check because netmount was not listed as a protected command. This allowed an attacker to craft a malicious web page that, when visited by a logged-in elFinder user, would force their browser to send a netmount request to the elFinder server.
Subsequently, the elFinder::netmount method, located in php/elFinder.class.php, would then receive and process the attacker-controlled parameters (protocol, host, path, port, user, pass, alias, options) without any prior CSRF validation. This allowed the attacker to dictate the details of the FTP mount, causing the PHP server to connect to an arbitrary FTP host and port with supplied credentials. The patch directly addresses this by adding 'netmount' => true, to the $csrfProtectedCmds array, ensuring that elFinderConnector::run now correctly enforces CSRF protection for this command.
elFinderConnector::runphp/elFinderConnector.class.php
elFinder::netmountphp/elFinder.class.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| studio-42/elfinder | composer | < 2.1.70 | 2.1.70 |