CVE-2026-91144CWE-639

CVE-2026-91144

High · published September 15, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00506 · 42.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-15T02:16Z
References (4)
https://github.com/zfile-dev/zfile · [email protected]https://github.com/zfile-dev/zfile/blob/5.0.5/src/main/java/im/zhaojun/zfile/module/share/service/ShareLinkFileService.java · [email protected]https://github.com/zfile-dev/zfile/issues/826 · [email protected]https://www.vulncheck.com/advisories/zfile-through-5.0.5-share-entry-filter-bypass-via-download-endpoint · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 21:45Z
    ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint
    cvelistv5