Threats tagged 'ghsa-q47w-6jpv-q372'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
High	8.7	CVE-2026-121555Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read High8.72026-11-03GCVE DatabaseCVE-2026-121555 Foxel versions up to 2.4.0 have a missing authentication vulnerability that permits unauthenticated attackers to read arbitrary files. This occurs via the /api/fs/stream and /api/fs/thumb endpoints, where attackers can specify a VFS mount prefix and relative path to access full file contents or thumbnails, bypassing PathRule permission controls. Report on CVE-2026-121555 Vulnerability CWE-306 #ghsa-q47w-6jpv-q372	GCVE Database	2026-11-03

Page 1 of 1