{"id":"CVE-2026-112240","kind":"vulnerability","aliases":["CVE-2026-112240"],"related":[],"title":"Form file download links use guessable tokens, exposing other visitors' uploads","description":"The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.","summary":"Download links for files uploaded through a web form rely on a predictable token and an unverified file name. An unauthenticated attacker can guess these to reach files uploaded by other visitors, and the token also appears in plain text in the notification email.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-uploads","other","web-forms"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T10:17:04+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:01:39+00:00","updated_at":"2026-10-25T04:01:39+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T04:01:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Form file download links use guessable tokens, exposing other visitors' uploads","impact":"medium","summary":"Download links for files uploaded through a web form rely on a predictable token and an unverified file name. An unauthenticated attacker can guess these to reach files uploaded by other visitors, and the token also appears in plain text in the notification email.","category":"other","nicknames":[],"who_cares":["web-forms","file-uploads"],"confidence":0.5,"needs_auth":"no","worst_case":"Unauthenticated attacker downloads other visitors' uploaded files","analyst_note":"Identify the product whose form-upload feature is affected and the fixed version; the NVD entry gives no product or version data.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000498,"input_tokens":3298,"output_tokens":336,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112240':14A,17A '-2026':13A,16A 'access':109C 'addit':116C 'also':60B,93C 'appear':61B 'attack':46B,104C 'could':83C,105C 'cve':12A,15A 'download':3A,25B,70C 'email':68B,131C 'expos':8A 'file':2A,19B,28B,42B,52B,73C,87C,110C 'file-upload':18B 'form':1A,24B,33B,77C 'guess':48B,101C 'guessabl':6A 'link':4A,26B,71C 'name':43B,88C 'notif':67B,130C 'plain':63B,122C 'predict':37B,85C 'reach':51B 'reli':34B,78C 'request':91C 'resist':100C 'shown':120C 'text':64B,123C,126C 'token':7A,38B,59B,81C,118C 'unauthent':45B,103C 'unverifi':41B 'upload':11A,20B,29B,53B,74C,111C 'use':5A,106C 'verifi':95C 'version':127C 'visitor':10A,56B,114C 'way':98C 'web':23B,32B 'web-form':22B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112240","severity":null,"published_at":"2026-10-20T10:17:04+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}