CVE-2026-121555 in Foxel
Summary
by MITRE • 11/03/2026
Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The security flaw identified in Foxel versions through 2.4.0 represents a critical failure in access control mechanisms, specifically categorized under CWE-306 as Missing Authentication for Critical Function. This vulnerability arises from the application's improper handling of requests directed at specific file system interaction endpoints, namely /api/fs/stream and /api/fs/thumb. These endpoints are designed to serve file contents or generate thumbnail previews but lack sufficient verification of user identity or session validity before processing input parameters. Consequently, any actor on the network can interact with these interfaces without providing valid credentials, effectively bypassing the intended security perimeter that should restrict access to authorized users only.
The technical mechanism of this exploitation involves manipulating two key input parameters: a Virtual File System mount prefix and a relative file path. By supplying arbitrary values for these fields, an attacker can traverse beyond their designated scope or even across different mounted storage locations within the Foxel environment. The application fails to validate whether the requesting user has permission to access the specified resource via PathRule grants. This oversight allows the system to resolve paths that should be restricted, leading to a complete breakdown of file-level authorization controls. The ability to specify arbitrary mount prefixes further exacerbates the risk by potentially exposing storage volumes or network shares that were not intended for general application use.
The operational impact of this vulnerability is severe, primarily manifesting as unauthorized data disclosure and potential information leakage. Attackers can retrieve full contents of sensitive files stored within the Foxel environment, including configuration files, user documents, logs, or proprietary code repositories depending on what is mounted to the system. Additionally, the ability to generate thumbnails for restricted assets allows attackers to confirm the existence and nature of hidden resources without necessarily downloading their entire content, facilitating further targeted attacks. This level of access undermines data integrity and confidentiality principles, potentially leading to compliance violations if regulated data such as personally identifiable information or financial records is exposed.
Mitigation strategies must focus on immediate remediation through software updates and temporary compensating controls. The primary solution is to upgrade Foxel to version 2.4.1 or later where this authentication bypass has been addressed by the vendor. In environments where patching is not immediately feasible, network-level restrictions should be implemented to limit access to these API endpoints exclusively from trusted internal subnets if possible. Furthermore, implementing strict input validation and enforcing PathRule permissions at the application logic layer before any file system operations are executed can help mitigate exposure until a permanent fix is deployed. Regular security audits of authentication flows for all public-facing or internally exposed APIs are recommended to prevent similar misconfigurations in other components.