https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-05T05:09:54.749261+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-121555 fkie_cve-2026-121555 2026-11-05T05:09:54.753720+00:00

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.

 https://db.gcve.eu/vuln/ghsa-q47w-6jpv-q372 GHSA-q47w-6jpv-q372 2026-11-05T05:09:54.753883+00:00

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.