---
id: "CVE-2026-112240"
kind: "vulnerability"
aliases: ["CVE-2026-112240"]
title: "Form file download links use guessable tokens, exposing other visitors' uploads"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["file-uploads", "other", "web-forms"]
not_affected_if: []
published_at: "2026-10-20T10:17:04+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:01:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112240", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Form file download links use guessable tokens, exposing other visitors' uploads

Download links for files uploaded through a web form rely on a predictable token and an unverified file name. An unauthenticated attacker can guess these to reach files uploaded by other visitors, and the token also appears in plain text in the notification email.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112240

## From the sources

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_