GNU Savane EUVD-2026-38135

The vulnerability is triggered through an HTTP request to the frontend/php/file.php endpoint in any Savane 3.14-3.17 deployment. No authentication is required (CVSS PR:N confirmed). The specific exploitation condition is that the authorization logic at lines 113 and 123 of file.php consumes a user-supplied HTTP parameter as a trust anchor rather than deriving authorization state exclusively from validated server-side session data. Exploitation is limited by High attack complexity (AC:H) - the attacker must know or enumerate the correct parameter name and value structure to influence the authorization outcome, making this unsuitable for blind mass-scanning. Impact is bounded to low confidentiality disclosure (C:L) of files accessible through that endpoint; no write capability or service disruption is possible through this vector. Deployments that do not expose the file download endpoint to untrusted networks are materially less exposed.

The overall risk signal is low-to-moderate. The NVD CVSS base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a network-reachable, zero-privilege attack surface but tempers it with High attack complexity and only Low confidentiality impact - no integrity or availability consequence is claimed. No EPSS score is available in the provided data, so exploitation probability cannot be quantified precisely. The vulnerability is not listed in CISA KEV, and no public POC or exploit code was identified in the references. The FSF has issued a public acknowledgment, and the hacktron.ai and mallory.ai references suggest independent security researcher discovery. Taken together, this is a real vulnerability with narrow but confirmed impact (information disclosure from a file-access bypass), not a critical priority - but Savannah hosts sensitive GNU project infrastructure, raising the organizational value of targeted exploitation above what raw CVSS implies. The AC:H rating credibly limits mass-automated exploitation.

An unauthenticated attacker with HTTP access to a Savane 3.14-3.17 instance crafts a request to frontend/php/file.php with a manipulated authorization parameter that the server-side logic accepts as trusted, substituting their own value for the expected session-derived authorization context. The server evaluates the tainted parameter in the access check at lines 113 or 123, concludes access is permitted, and returns a file from a restricted project that the attacker would not otherwise be authorized to retrieve. No public POC code has been identified; the AC:H CVSS rating indicates the attacker must have specific knowledge of the parameter structure or target file identifiers to succeed.