EUVD-2026-60470
GHSA-rw94-73mp-v8hw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no authentication required; high confidentiality impact via unrestricted file read; no integrity or availability impact applies.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves the request to the protected file, enabling unauthorized file download without credentials.
AnalysisAI
Unauthorized file download in Typemill before 2.26.0 is achievable by unauthenticated remote attackers through a path-equivalence authorization bypass in the media file download controller. The role-based restriction map is consulted using the raw, unnormalized URL-supplied filename, while the PHP filesystem layer transparently resolves path-equivalent forms - dot-slash prefixes, double slashes, and percent-encoded separators - to the actual protected file, producing an authorization mismatch that allows restricted media to be served without credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The primary prerequisite is that the Typemill installation must have at least one file entry configured in filerestrictions.yaml - without any restriction rules defined, there are no protected files to bypass access controls for, making the vulnerability moot. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H accurately reflects the real-world risk: the attack is network-accessible, requires no authentication, no user interaction, and no special preconditions beyond a standard Typemill installation that has at least one file listed in filerestrictions.yaml. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Typemill to version 2.26.0 or later, which is the vendor-released patch confirmed by the GitHub release tag (https://github.com/typemill/typemill/releases/tag/v2.26.0) and the remediation commit (8c621063b4697a94342cb0a4b3905adda60e3d25). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Typemill installations and verify their versions are below 2.26.0 to confirm exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today