CVE Intelligence

Zfile-dev Zfile vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Zfile-dev Zfile: 1 record(s), with affected versions and fixes.

CVE-2026-91144 High · 7.5 CWE-639 Sep 14, 2026
ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.