Foxel
Monthly
Foxel through 2.4.0 exposes its virtual filesystem read endpoints, /api/fs/stream and /api/fs/thumb, without any authentication dependency or per-path permission check, so an unauthenticated remote attacker who can reach the instance can retrieve full file contents or generated thumbnails by supplying a VFS mount prefix and a relative path - even for paths that PathRule grants never authorized. The upstream fix commit 73d9fa8 adds a Bearer-token requirement plus a READ path-permission decorator to both handlers and replaces raw stream URLs in the web client with short-lived signed links, and the issue is assessed as a genuine high-priority unauthenticated data-disclosure flaw rather than a CVSS-inflated one. No CISA KEV listing and no public exploit code were identified at time of analysis, though the endpoints are trivially reachable by any client that can perform an HTTP GET, so the practical limiter is network exposure of the Foxel API rather than any attacker prerequisite.
Foxel through 2.4.0 exposes its virtual filesystem read endpoints, /api/fs/stream and /api/fs/thumb, without any authentication dependency or per-path permission check, so an unauthenticated remote attacker who can reach the instance can retrieve full file contents or generated thumbnails by supplying a VFS mount prefix and a relative path - even for paths that PathRule grants never authorized. The upstream fix commit 73d9fa8 adds a Bearer-token requirement plus a READ path-permission decorator to both handlers and replaces raw stream URLs in the web client with short-lived signed links, and the issue is assessed as a genuine high-priority unauthenticated data-disclosure flaw rather than a CVSS-inflated one. No CISA KEV listing and no public exploit code were identified at time of analysis, though the endpoints are trivially reachable by any client that can perform an HTTP GET, so the practical limiter is network exposure of the Foxel API rather than any attacker prerequisite.