What’s Vulnerable › Vulnerabilities

CVE-2019-6257

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-01-14 · updated 2026-06-17
• Weakness: CWE-918

Description

A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. This occurs in get_remote_contents() in php/elFinder.class.php.

Affected products

• Studio-42 elFinder: before 2.1.46 — fixed in 2.1.46

How to fix

Upgrade to a fixed version: Studio-42 elFinder 2.1.46. Check the vendor advisory for mitigations.

References

• https://github.com/Studio-42/elFinder/blob/68ec63c0aeca3963101aca8f842dc9f2e4c4c6d3/Changelog
• https://github.com/Studio-42/elFinder/commit/2f522db8f037a66ce9040ee0b216aa4a0359286c
• https://github.com/Studio-42/elFinder/blob/68ec63c0aeca3963101aca8f842dc9f2e4c4c6d3/Changelog
• https://github.com/Studio-42/elFinder/commit/2f522db8f037a66ce9040ee0b216aa4a0359286c

Get alerted when CVE-2019-6257 or the next vulnerability affects your stack