Security Advisory

CVE-2026-91144

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-14 21:45:44

Last updated 2026-09-14 21:45:44

Assigner VulnCheck

CVSS score 8.7

State PUBLISHED

Description

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.

← Browse all CVEs View on cve.org ↗