CVE Intelligence

Zfile-dev vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Zfile-dev products: 1 record(s), with severity, exploitation and fixes.

Zfile 1

Exploited only (KEV) →

CVE-2026-91144 High · 7.5 CWE-639 Sep 14, 2026
ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.