What is the CVSS score of CVE-2026-52100?

CVE-2026-52100 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-52100?

Within 24 hours: inventory all linx-server instances and determine which are internet-accessible; immediately restrict network access to upload endpoints if publicly exposed. Within 7 days: implement network segmentation (restrict uploads to internal-only access), deploy WAF rules enforcing CSRF token validation, or disable file upload functionality if not operationally critical. Within 30 days: monitor the linx-server GitHub repository for a patched release; plan an upgrade to the first patched version when released, or migrate to an actively maintained file-sharing platform.

CVE-2026-52100

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-14 cve@mitre.org

RCE CSRF

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 15:25 vuln.today

CVSS changed

Jul 15, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Jul 14, 2026 - 21:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 14, 2026 - 21:17 cve.org

HIGH 7.5

DescriptionCVE.org

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function

AnalysisAI

Arbitrary code execution in andreimarcu linx-server (a self-hosted file/media sharing service) versions 1.0 through 2.3.8 can be triggered by a remote attacker abusing a Cross-Site Request Forgery flaw in the uploadPutHandler function, per NVD and MITRE. Because the upload endpoint lacks anti-CSRF protection, an attacker can forge upload requests that ride an authenticated victim's session to achieve code execution. No public exploit has been identified in the provided data, though a third-party vulnerability report is referenced; the flaw is not listed in CISA KEV and no EPSS score was supplied.