CVE-2026-91144 ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint
Attackers with a share link can bypass access restrictions to download arbitrary files from the shared directory via the download endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91144?
CVE-2026-91144 is a high-severity path traversal vulnerability in zfile-dev zfile, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.
Weakness: CWE-639
Which versions are affected by CVE-2026-91144?
How do I fix CVE-2026-91144?
No fix has been published for CVE-2026-91144 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-91144 being exploited?
There is no known exploitation of CVE-2026-91144 in the wild and no public exploit code.
Sources
Also known as GHSA-rq8c-9999-42w5.