CVE-2026-81889
1 advisory.
Packagist/studio-42/elfinder CVE-2026-81889: high 8.6, EPSS 0.55%
elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
Action: Upgrade studio-42/elfinder to 2.1.70 or later.
composer require studio-42/elfinder:2.1.70Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.70 | - |
Fixed versions
| 2.1.70 |
Sources
- osv: GHSA-8x3q-jpjh-qh5c
- https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c
- https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff
- https://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51
- https://github.com/Studio-42/elFinder
- https://github.com/Studio-42/elFinder/releases/tag/2.1.70
CVE-2026-81889 · published · modified · JSON