CVE-2026-71518 Typemill < 2.26.0 Authorization Bypass via Media File Download Route
Unauthenticated attackers can bypass authorization checks in Typemill to download restricted media files using path manipulation techniques.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71518?
CVE-2026-71518 is a high-severity authentication bypass vulnerability in typemill, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves the request to the protected file, enabling unauthorized file download without credentials.
Weakness: CWE-863
Which versions are affected by CVE-2026-71518?
How do I fix CVE-2026-71518?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-71518 being exploited?
There is no known exploitation of CVE-2026-71518 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-rw94-73mp-v8hw.