CVE-2026-121555

EUVD-2026-115900
Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/DrizzleTime/Foxel
https://github.com/DrizzleTime/Foxel/blob/v2.4.0/api/routers.py#L31
https://github.com/DrizzleTime/Foxel/blob/v2.4.0/domain/virtual_fs/api.py#L164-L182
https://github.com/DrizzleTime/Foxel/commit/73d9fa825e1004d37abb7b10faea0cd7f5bcb463
https://github.com/DrizzleTime/Foxel/issues/152
https://www.vulncheck.com/advisories/foxel-through-2.4.0-unauthenticated-file-read-via-api-fs-stream-and-api-fs-thumb