php/elFinder.class.php in elFinder prior to 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.
std42 elfinder