AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-31T21:17:52.460Z and has not been modified since then. The NVD entry is currently 8.6 HIGH. This server-side request forgery vulnerability in elFinder, prior to version 2.1.70, allows an attacker to use DNS rebinding to store the internal HTTP response body as an uploaded file, making it readable th [truncated]
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.68, an authenticated SQL injection vulnerability in the elFinder MySQL volume driver (elFinderVolumeMySQL) allows any logged-in user, including users with read-only access to the affected volume, to inject SQL through a crafted target file hash. Successful exploitation can lead to unauthorized data disclos [truncated]
