elFinder, an open‑source web file manager, contains a flaw that lets an attacker use DNS rebinding on the URL upload feature to cause the server to resolve a hostname twice: the first lookup resolves to a public address, while the second, performed by the fallback fsock_get_contents function, resolves to a loopback or private address. The attacker can then have elFinder fetch internal resources, store the retrieved content as an uploaded file, and read it later through the manager. Additionally, the get_headers call demonstrates a blind SSRF path even when cURL is available, making the exposure broader than a single upload path.

All Studio‑42 elFinder installations on versions prior to 2.1.70 are vulnerable. The issue is corrected in elFinder 2.1.70 and later releases.

The CVSS score of 8.6 indicates a high severity, and the lack of an EPSS score or KEV listing does not mitigate the risk of exploitation. Attackers can remotely trigger the vulnerability via the public upload endpoint without needing local credentials, enabling internal data exfiltration or potentially further lateral movement.