What is the CVSS score of CVE-2026-52101?

CVE-2026-52101 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Linx are affected by CVE-2026-52101?

Linx file server versions 1.0-2.3.8 contain a critical information disclosure vulnerability allowing unauthenticated attackers to retrieve sensitive data by exploiting the uploadRemote function.

How to fix or mitigate CVE-2026-52101?

Within 24 hours: inventory all systems running Linx versions 1.0-2.3.8 and restrict network access to the uploadRemote endpoint using firewall rules or reverse proxy configuration; document current data exposure. Within 7 days: disable the uploadRemote function entirely if operationally feasible, implement request-level controls (IP whitelisting, authentication enforcement at the reverse proxy) as interim defense, and audit access logs for suspicious upload activity. Within 30 days: migrate to a patched alternative file-sharing solution or retire Linx in favor of a maintained product with security governance, since no vendor patch exists for this line.

Linx CVE-2026-52101

CRITICAL

Information Exposure (CWE-200)

2026-07-14 cve@mitre.org

Information Disclosure

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated URL-based upload yields high confidentiality disclosure (C:H); the description and CWE-200 indicate no integrity or availability impact, so I:N/A:N contrary to the input's I:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 15:25 vuln.today

CVSS changed

Jul 15, 2026 - 15:22 NVD

9.1 (CRITICAL)

CVE Published

Jul 14, 2026 - 21:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 14, 2026 - 21:17 cve.org

CRITICAL 9.1

DescriptionCVE.org

An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go

AnalysisAI

Information disclosure in andreimarcu Linx (linx-server) versions 1.0 through 2.3.8 lets remote attackers retrieve sensitive data through the uploadRemote function in upload.go, which fetches attacker-supplied remote URLs on the server's behalf. The flaw carries a CVSS 9.1 rating with a network, unauthenticated, low-complexity vector, so exploitation requires no credentials or user interaction. No public exploit is identified, though a third-party vulnerability report is published for the CVE.

Technical ContextAI

Linx is a self-hosted, open-source file and media sharing server written in Go (andreimarcu/linx-server) that offers URL-based ('remote') uploads in addition to direct uploads. The affected uploadRemote function in upload.go accepts a user-supplied URL and has the server download that resource - a design pattern that classically enables server-side request forgery. The assigned CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) points at the root cause being that the server can be coerced into fetching and exposing content the requester should not be able to reach, such as internal-network endpoints, cloud metadata services, or local files, and returning that data back to the attacker.

Affected ProductsAI

andreimarcu Linx (linx-server), a self-hosted file/media sharing server, versions 1.0 through 2.3.8 inclusive, are affected. No CPE string was provided in the intelligence. The upstream project is at https://github.com/andreimarcu/linx-server and a CVE-specific report is available at https://github.com/nk7667/-linx-server-vulnerability-report/blob/main/CVE-2026-52101.md. No vendor security advisory URL was supplied.

RemediationAI

No vendor-released patch or fixed version was identified in the available data, so no confirmed upgrade target can be cited; monitor https://github.com/andreimarcu/linx-server for a release above 2.3.8 addressing the uploadRemote path. As specific compensating controls: disable the remote-upload feature so uploadRemote cannot be invoked (trade-off: users lose URL-based uploads), place Linx behind authentication or an allowlist proxy so only trusted users can submit upload requests, and use egress network controls to prevent the server from reaching internal ranges (RFC1918), localhost, and cloud metadata endpoints such as 169.254.169.254 (trade-off: may break legitimate remote uploads from internal sources). Review the referenced report at https://github.com/nk7667/-linx-server-vulnerability-report/blob/main/CVE-2026-52101.md for exact reproduction details before validating any mitigation.