elFinder Server Side Request Forgery (SSRF)

HIGH 7.7CVE-2019-6257 · GHSA-3qhm-qfj3-4rrx · Published 14/01/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
studio-42/elfinder Packagist	`< 2.1.49`	`2.1.49`
elfinder std42	`< 2.1.46`	`2.1.46`

Description

A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.49 could allow a malicious user to access the content of internal network resources. This occurs in get_remote_contents() in php/elFinder.class.php.

NVD description

A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. This occurs in get_remote_contents() in php/elFinder.class.php.

References

nvd.nist.gov/vuln/detail/CVE-2019-6257 · ADVISORY
Studio-42/elFinder commit 2f522db · WEB
FriendsOfPHP/security-advisories · WEB
Studio-42/elFinder · PACKAGE
Studio-42/elFinder · WEB
Studio-42/elFinder release 2.1.49 · WEB
Studio-42/elFinder · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free