Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-91144

ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint

CVSS 4.0 8.7 HIGHCVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-91144

Published

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-91144

Published

zfile

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "zfile-dev",
                    "product": "zfile",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "0",
                            "lessThanOrEqual": "5.0.5",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ],
                    "repo": "https://github.com/zfile-dev/zfile"
                }

Original source record · Cite this exact observation · Complete original publisher JSON