CVE-2026-123197 · Package
NO FIX YET · SEE WHAT TO DO
WPPConnect Server, a WhatsApp automation server, serves decrypted sticker images through a static /files mount without checking authentication. An unauthenticated attacker can guess Unix timestamps in file names to download stickers from any session.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running WPPConnect Server exposed to a network where the /files static mount is reachable. Deployments that do not expose that mount, or that sit behind an authenticating proxy, are less exposed. The sources do not give a fixed version.
Not affected if auth-required, mount-not-exposed
Who cares self-hosted, whatsapp-automation, wppconnect-server
2.10.76 is affected./files static route on the server that serves file<timestamp>.webp paths.WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.