What is the CVSS score of CVE-2026-51026?

CVE-2026-51026 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

FileThingie CVE-2026-51026

EUVD-2026-45990 MEDIUM

Relative Path Traversal (CWE-23)

2026-07-20 mitre

GHSA-46gg-rx3v-33gc

Path Traversal N A

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via HTTP; PR:L reflects application-level login requirement; C:H for arbitrary file read; no write or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:14 vuln.today

DescriptionCVE.org

Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request.

AnalysisAI

Directory traversal in FileThingie v.2.5.7 allows a remote, low-privileged attacker to read arbitrary files outside the application's intended directory boundary via a crafted HTTP request. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation with high confidentiality impact and no write or availability consequences. No confirmed active exploitation (CISA KEV) is recorded, but a public vulnerability research repository referencing this CVE exists, suggesting proof-of-concept material may be available.

Technical ContextAI

FileThingie is a PHP-based single-file web file manager hosted at https://github.com/leefish/filethingie, designed for lightweight browser-based file browsing and management. Directory traversal vulnerabilities - classically CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) - arise when user-supplied input used to construct filesystem paths is not sanitized to strip or reject sequences such as ../ and their URL-encoded equivalents (%2e%2e%2f). In this case, a crafted HTTP request manipulates a path parameter to escape the web root, causing the server to resolve and return file contents from arbitrary locations on the underlying filesystem. The CWE field in the source data is listed as N/A, but the 'Path Traversal' tag and description are unambiguously consistent with CWE-22. The CPE string (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) is a generic placeholder providing no additional product scoping.

RemediationAI

No vendor-released patch has been identified at time of analysis. Administrators running FileThingie v.2.5.7 should monitor the upstream repository at https://github.com/leefish/filethingie for commits or tagged releases that address path sanitization. As a compensating control, restrict access to the FileThingie deployment using IP-based allowlisting at the web server level (e.g., Require ip in Apache or allow from in nginx), reducing the attacker pool given that PR:L is already a prerequisite - note this does not eliminate the vulnerability. Deploying a WAF rule to block ../, %2e%2e/, and related traversal patterns in request parameters provides shallow mitigation but is bypassable via less common encoding variants. Given FileThingie's niche footprint and absence of an upstream patch, removing the application from internet-facing deployments until a fix is confirmed is the most conservative and effective control.