Product
elFinder 2.1.69 and earlier are vulnerable to a DNS rebinding SSRF attack when PHP cURL is unavailable, allowing attackers to access internal or loopback network services.