Folio Client
Monthly
Unauthenticated web origins can invoke local Fabasoft Folio Client functions on any Windows machine where both the Folio Client (builds before 26.0.0.10, or 26.x before the 26.4.0.76 April Release) and its companion browser extension are installed and the registry value VALIDDOMAINS is left unset - which is the shipped default, so every website is trusted. Because the client validates no calling origin, any page a user simply visits can trigger client operations such as downloading documents, opening documents, and synchronizing files, giving an attacker a drive-by means to influence document handling and file synchronization without any credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N per the CVE record; our assessment scores it slightly lower at C:L/I:L/A:N given the functional scope observed). Exploitation requires the victim to browse attacker-controlled or compromised content, and there is no public exploit code identified at time of analysis - this is a moderate, opportunistic-risk issue rather than an urgent priority, and organizations that had already populated VALIDDOMAINS with an origin allowlist, or that upgrade to the fixed builds, are not exposed.
Unauthenticated web origins can invoke local Fabasoft Folio Client functions on any Windows machine where both the Folio Client (builds before 26.0.0.10, or 26.x before the 26.4.0.76 April Release) and its companion browser extension are installed and the registry value VALIDDOMAINS is left unset - which is the shipped default, so every website is trusted. Because the client validates no calling origin, any page a user simply visits can trigger client operations such as downloading documents, opening documents, and synchronizing files, giving an attacker a drive-by means to influence document handling and file synchronization without any credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N per the CVE record; our assessment scores it slightly lower at C:L/I:L/A:N given the functional scope observed). Exploitation requires the victim to browse attacker-controlled or compromised content, and there is no public exploit code identified at time of analysis - this is a moderate, opportunistic-risk issue rather than an urgent priority, and organizations that had already populated VALIDDOMAINS with an origin allowlist, or that upgrade to the fixed builds, are not exposed.