CVE-2026-91144

ZFile, a self-hosted online file-storage and file-listing application, fails through version 5.0.5 to validate the file path supplied to its download endpoint against the entries a share link is permitted to serve. An attacker who has obtained any valid share link URL can substitute arbitrary path query parameters and download any file stored under the shared base directory, bypassing the intended per-link access restrictions. This is an authorization bypass on direct object references (CWE-639) that exposes confidential files without requiring authentication to the application or any user interaction. Any deployment running ZFile 5.0.5 or earlier that exposes share links to untrusted parties is affected. The flaw carries a CVSS 4.0 score of 8.7 (high); it is not in CISA's KEV catalog, no public proof of concept is known, and no exploitation has been observed.

What to do: Upgrade ZFile to the latest available release, since all versions through 5.0.5 are affected and no fixed version below that exists. Until patched, disable or revoke existing share links so untrusted holders cannot reach the download endpoint, and place the instance behind an access-restricted reverse proxy or VPN. Review download logs and server-side file access for anomalous path parameters on the download endpoint to rule out prior abuse.