CVE-2026-121555

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all...

CVE-2026-121555

Versions of Foxel through 2.4.0 are vulnerable to an unauthenticated file read vulnerability due to missing authentication on the /api/fs/stream and /api/fs/thumb endpoints. An unauthenticated attacker can supply a VFS mount prefix and a relative path to retrieve full file contents or thumbnails ...

CVE-2026-121555 Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all...

EUVD-2026-115900

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all...

CVE-2026-121555: DrizzleTime Foxel: Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files…

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all...