Description

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves the request to the protected file, enabling unauthorized file download without credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T21:16:48.277Z",
  "pubdate": "2026-08-17T21:16:48.277Z",
  "executiveSummary": "Typemill before 2.26.0 suffers from an authorization bypass vulnerability residing within the media file download route. This security flaw enables unauthenticated remote attackers to bypass role-based restriction checks and illicitly download restricted files from the underlying filesystem. The root cause stems from a discrepancy between how authorization logic validates requested paths and how the filesystem subsequently resolves them.\nBy submitting maliciously crafted, path-equivalent URL variants containing normalization artifacts such as dot-slash prefixes, double slashes, or percent-encoded sequences, an attacker can successfully evade security controls without possessing any valid credentials or privileges. The impact of this vulnerability includes the unauthorized exposure of sensitive or restricted media assets, potentially leading to information disclosure and the compromise of confidential data managed by the application.\nNo specialized privileges are required to mount this attack, and the exploitation vector is network-accessible. Remediation requires upgrading Typemill to version 2.26.0 or later, where proper path normalization and strict authorization enforcement are implemented to prevent unauthorized access attempts.",
  "technicalDetails": "The vulnerability is located in the media file download route of Typemill before 2.26.0. The core security flaw represents an authorization bypass vulnerability driven by improper input validation and path normalization handling during access control evaluation.\nThe attack flow proceeds as follows: an unauthenticated attacker targets the media file download functionality. The application implements role-based restriction checks designed to inspect the incoming request path against a whitelist or blacklist of permitted resources. However, the security check evaluates the raw or improperly normalized string provided in the URL.\nTo exploit this mechanism, the attacker crafts path-equivalent URL variants by substituting normalized path forms. These variations include dot-slash prefixes, consecutive double slashes, or percent-encoded sequences. When the security validation routine parses the string, the string fails to match the restricted pattern or incorrectly evaluates as a safe path, thereby bypassing the role-based access control check.\nSubsequently, when the underlying operating system or application filesystem handling routines process the request, the path resolver canonicalizes or interprets the variants, resolving the input directly to the protected target file. Because the authorization layer has already granted clearance based on the unnormalized string, the server proceeds to read and transmit the contents of the restricted file back to the unauthenticated user.\nThe vulnerable component handles file retrieval operations over network exposures without requiring authentication or privileges. The post-exploitation impact includes unauthorized data exfiltration, disclosure of private media files, and potential exposure of sensitive application assets that should otherwise be protected behind administrative or authenticated boundaries."
}