Compound WireTHE STANDUP31 August 2026
elFinder
DNS REBIND PAST THE SSRF CHECK
elFinder SSRF check bypassed by DNS rebinding after the domain passes
poc.zip ## Summary
elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass when PHP cURL is unavailable and URL uploads use the fsock_get_contents() fallback.
An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially resolves to an allowed public IP address and subsequently resolves to a loopback or private IP address.
The URL validation checks the first resolved IP, but fsock_get_contents() opens the actual connection using the original