Live › vulnerability › CVE-2026-121555
Foxel through version 2.4.0 exposes its /api/fs/stream and /api/fs/thumb endpoints without requiring login. An unauthenticated attacker can supply a mount prefix and path to download full file contents or thumbnails from any mount, bypassing PathRule permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Teams running a self-hosted Foxel instance that exposes the file API to a network reachable by others. The sources describe the flaw as affecting all mounts and bypassing PathRule grants, so any file reachable through Foxel's virtual file system is at risk. Instances not reachable from untrusted networks are less exposed, but the sources do not say more.
No product ranges from the sources yet.
2.4.0 are listed as affected./api/fs/stream or /api/fs/thumb without a session token and see whether file content is returned.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.
This page as .md · .json · in your agent: get_signal("CVE-2026-121555")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.