elFinder fsock_get_contents Disclosure

The vulnerability of the fsockgetcontents function in the elFinder file manager is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a remote attacker to disclose sensitive information that should be protected...

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

poc.zip Summary elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery SSRF protection bypass when PHP cURL is unavailable and URL uploads use the fsockgetcontents fallback. An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially...

GHSA-8X3Q-JPJH-QH5C elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

poc.zip Summary elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery SSRF protection bypass when PHP cURL is unavailable and URL uploads use the fsockgetcontents fallback. An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially...

Server-side Request Forgery (SSRF)

Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the fsockgetcontents process when PHP cURL is unavailable and URL uploads are used. An attacker can...

CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-81889

elFinder (open-source web file manager) contains an SSRF protection bypass in php/elFinder.class.php prior to version 2.1.70 . When PHP cURL is unavailable, get_remote_contents() falls back to fsock_get_contents(), which performs a second DNS resolution to $arr['host'] independent of the IP alrea...

EUVD-2026-68768

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...