{"action":"Upgrade studio-42/elfinder to 2.1.70 or later.","affected":[{"fixed":"2.1.70","introduced":"0"}],"component":"studio-42/elfinder","cve_ids":["CVE-2026-81890"],"ecosystem":"Packagist","epss":0.00177,"exploited":false,"fixed_versions":["2.1.70"],"ghsa_id":"GHSA-9hjf-w35w-6vx2","id":"tcs_01M5KF02R71Q59GZVJGAH68TMA","modified_at":"2026-09-02T14:45:05.145444935Z","published_at":"2026-09-02T14:37:36Z","references":["https://osv.dev/vulnerability/GHSA-9hjf-w35w-6vx2","https://github.com/Studio-42/elFinder/security/advisories/GHSA-9hjf-w35w-6vx2","https://nvd.nist.gov/vuln/detail/CVE-2026-81890","https://github.com/Studio-42/elFinder/commit/31284facd033e081b2b69c08873b39c8a413b762","https://github.com/Studio-42/elFinder/commit/36d40fff12222ad4c229d8889d8ed3fd3dbf0415","https://github.com/Studio-42/elFinder","https://github.com/Studio-42/elFinder/releases/tag/2.1.70"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-9hjf-w35w-6vx2","url":"https://osv.dev/vulnerability/GHSA-9hjf-w35w-6vx2"}],"summary":"elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections"}