CVE-2026-81889: Server-Side Request Forgery (SSRF)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

PT-2019-18055

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.49 Description A Server Side Request Forgery SSRF issue allows a malicious user to access the content of internal network resources. This occurs in the get remote contents function in php/elFinder.class.php...

CVE-2019-6257: Server-Side Request Forgery (SSRF)

A Server Side Request Forgery SSRF vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. This occurs in getremotecontents in php/elFinder.class.php...

CVE-2019-5884

php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safemode or openbasedir is not set...

PT-2019-17842

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.45 Description The issue is related to information leakage in the php/elFinder.class.php file of elFinder. This occurs when PHP's curl extension is enabled and either safe mode or open basedir is not set...

CVE-2019-5884: Exposure of Sensitive Information to an Unauthorized Actor

php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safemode or openbasedir is not set...