← Database

CVE-2026-121555

HIGH CVSS: 7.5 Published: 2026-11-03 Modified: 2026-11-03

Description

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.

Affected Platforms

Unknown

Weakness Type

CWE-306

References