{"id":"CVE-2026-121555","published":"2026-11-03T16:17:27.800","lastModified":"2026-11-03T19:18:04.867","description":"Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/DrizzleTime/Foxel","tags":[]},{"url":"https://github.com/DrizzleTime/Foxel/blob/v2.4.0/api/routers.py#L31","tags":[]},{"url":"https://github.com/DrizzleTime/Foxel/blob/v2.4.0/domain/virtual_fs/api.py#L164-L182","tags":[]},{"url":"https://github.com/DrizzleTime/Foxel/commit/73d9fa825e1004d37abb7b10faea0cd7f5bcb463","tags":[]},{"url":"https://github.com/DrizzleTime/Foxel/issues/152","tags":[]},{"url":"https://www.vulncheck.com/advisories/foxel-through-2.4.0-unauthenticated-file-read-via-api-fs-stream-and-api-fs-thumb","tags":[]}],"exploitRefs":[{"url":"https://github.com/DrizzleTime/Foxel","tags":[]},{"url":"https://github.com/DrizzleTime/Foxel/blob/v2.4.0/api/routers.py#L31","tags":[]},{"url":"https://github.com/DrizzleTime/Foxel/blob/v2.4.0/domain/virtual_fs/api.py#L164-L182","tags":[]},{"url":"https://github.com/DrizzleTime/Foxel/commit/73d9fa825e1004d37abb7b10faea0cd7f5bcb463","tags":[]},{"url":"https://github.com/DrizzleTime/Foxel/issues/152","tags":[]}],"hasPoc":true,"ai":null}