CVE-2026-91144 in ZFile
Summary
by MITRE • 09/15/2026
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability in ZFile versions through 5.0.5 represents a critical failure in path validation logic within the application's file sharing mechanism. Specifically, the flaw resides in how the software handles requests to download files via share links. When an authenticated or unauthenticated user utilizes a valid share link provided by another user, they are granted access only to specific directories and files designated as allowed entries for that particular share session. However, the underlying implementation fails to rigorously validate the requested file path against this whitelist of permitted paths before processing the download request. This oversight allows an attacker who possesses a legitimate share link to manipulate query parameters containing arbitrary file system paths. By injecting sequences such as dot-dot-slash patterns or absolute paths that resolve within the shared base directory, the application incorrectly interprets these inputs and serves files that were not explicitly authorized for sharing through that specific link.
From a technical perspective, this issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The root cause lies in the insufficient sanitization of user-supplied input before it is used to construct file system operations. Instead of strictly comparing the resolved absolute path of the requested resource against the predefined list of allowed paths associated with the share link, the application likely relies on less secure methods such as simple string matching or incomplete normalization checks. This allows attackers to bypass access controls by navigating outside the intended scope of the shared directory structure, provided that any file they attempt to access remains within the broader base directory assigned to the share operation. The vulnerability exploits the trust placed in the integrity of query parameters without verifying their alignment with security policies defined at the time of link generation.
The operational impact of this vulnerability is significant for organizations and individuals using ZFile as a private or semi-public file storage solution. An attacker can exfiltrate sensitive documents, configuration files, database dumps, or other confidential data that resides within the shared base directory but was not intended to be accessible via public share links. This constitutes a direct breach of confidentiality and integrity principles. Since the attack requires only possession of a valid share link, which may be obtained through social engineering, phishing, or accidental exposure on forums or repositories, the barrier to exploitation is low. The severity escalates if the shared base directory contains credentials, private keys, or proprietary source code that could lead to further compromise of downstream systems or intellectual property theft.
To mitigate this vulnerability, immediate updates to ZFile are recommended as newer versions likely contain patches addressing these path validation issues. In environments where upgrading is not immediately feasible, administrators should implement strict input validation at the web server level using reverse proxy configurations such as Nginx or Apache to reject requests containing suspicious characters like dot-dot-slash sequences before they reach the application backend. Additionally, enforcing least-privilege principles for file system permissions ensures that even if path traversal occurs, the operating system restricts access to sensitive files outside the designated share scope. Regular security audits and static code analysis focused on CWE-22 patterns can help identify similar flaws in custom implementations or other components of the application stack. Monitoring logs for unusual download patterns involving encoded slashes or directory navigation attempts provides an additional layer of defense through detection capabilities aligned with MITRE ATT&CK techniques related to data exfiltration via file transfer protocols.