Which versions of ZFile are affected by CVE-2026-91144?

ZFile versions through 5.0.5 contain a path traversal vulnerability in its file-sharing feature that allows any holder of a share link to access all files in the shared directory instead of only the…

How to fix or mitigate CVE-2026-91144?

Within 24 hours: Inventory all active share links in ZFile and verify which files each link holder should have access to versus the full directory contents they could currently access through path traversal. Within 7 days: Restrict base directory permissions at the filesystem level to limit the attack surface; enable detailed logging of all share link downloads to detect anomalous access patterns; and disable the share link feature if not operationally critical. Within 30 days: Monitor ZFile's official channels and GitHub issue #826 for patch availability; once a patched version is released and verified, upgrade all ZFile instances to the latest version and re-enable share links only after confirming the fix.

ZFile CVE-2026-91144

Q: What is the CVSS score of CVE-2026-91144?

CVE-2026-91144 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-78167 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-09-14 disclosure@vulncheck.com

GHSA-rq8c-9999-42w5

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

PR:L reflects that a valid share link (a low-privilege credential) is required; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 15, 2026 - 07:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 15, 2026 - 07:26 vuln.today

CVE Published

Sep 14, 2026 - 22:16 cve.org

HIGH 8.7

DescriptionCVE.org

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.

AnalysisAI

Path traversal via share link in ZFile through 5.0.5 enables any holder of a valid share link to download arbitrary files within the configured shared base directory by supplying unvalidated file path parameters to the download endpoint. The root failure - confirmed in ShareLinkFileService.java - is that the download endpoint never cross-checks the caller-supplied path against the share link's permitted entries, so a share granting access to one file silently grants read access to every readable file under the base directory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The sole prerequisite is possession of a valid share link for the target ZFile instance - no account credentials, administrative access, or elevated privileges are required beyond holding that link. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N/VC:H accurately captures the network-reachable, low-friction nature of this issue once a share link is in hand. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No specific patched version number is confirmed in any available source; operators should monitor the ZFile GitHub repository at https://github.com/zfile-dev/zfile and the VulnCheck advisory at https://www.vulncheck.com/advisories/zfile-through-5.0.5-share-entry-filter-bypass-via-download-endpoint for patch release confirmation and upgrade immediately when a fixed version is available. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all active share links in ZFile and verify which files each link holder should have access to versus the full directory contents they could currently access through path traversal. …

Threat intelligence, references, and detailed analysis are available after sign-in.