Sensitive Data Exposure in elFinder

MEDIUM 5.9CVE-2019-5884 · GHSA-jcgc-vxqg-85xx · Published 10/01/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
studio-42/elfinder Packagist	`< 2.1.45`	`2.1.45`
elfinder std42	`< 2.1.45`	`2.1.45`

Description

php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.

NVD description

php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.