The vulnerability is a CSRF flaw in elFinder’s netmount command, which was omitted from the list of CSRF‑protected operations before version 2.1.70. An attacker can issue a forged request from any third‑party domain that forces the PHP server to establish an outgoing FTP connection to a host chosen by the attacker, using attacker‑supplied credentials. The resulting server‑side FTP session can be used to read, write, or delete files on the target server, and if the remote FTP host returns scripts or executable payloads, this could lead to remote code execution or other malicious actions. By persisting this mount in an authenticated user session, the attacker can repeatedly access privileged file system locations without needing to authenticate again.

All installations of Studio‑42’s elFinder file manager running versions earlier than 2.1.70 are affected. The issue manifests when the default minimal configuration that enables FTP network mounts is used, as the FTP parameters are passed directly to elFinder::netmount() and subsequently to the FTP volume class. Users should verify the exact version deployed and confirm that the 2.1.70 or later release is in use.

The CVSS score of 5.4 places this vulnerability in the moderate range. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by creating a cross‑site request from an arbitrary domain that targets a victim who is logged into the elFinder web interface. Because the flaw is a CSRF issue, the attacker does not need direct access to the victim machine; it merely needs the victim to be an authenticated user in a browser session. Once the forged request is processed, the PHP backend initiates an outbound FTP connection to a host selected by the attacker. The lack of CSRF token enforcement is the primary weakness (CWE‑352).