CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...