CVE-2026-51026 describes a directory traversal vulnerability in FileThingie v2.5.7. This vulnerability allows a remote attacker with low privileges to obtain sensitive information by crafting a specific request that traverses directories outside the intended scope. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality. There is no information on available patches or vendor advisories, and no known exploits in the wild have been reported.

An attacker can remotely access sensitive files on the affected system without requiring user interaction, potentially leading to unauthorized disclosure of confidential information. The integrity and availability of the system are not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the FileThingie service to trusted users and networks to reduce exposure.