Threats affecting pkg:github/zfile

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.7	EPSS 0.5%	CVE-2026-91144zfile · Insecure Direct Object Reference High8.7EPSS 0.5%2026-09-14CVE Database V5CVE-2026-91144 ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions. EPSS 0.5%Vulnerability zfile-dev #ghsa-rq8c-9999-42w5	CVE Database V5	2026-09-14

Page 1 of 1