Description

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T22:16:59.053Z",
  "pubdate": "2026-09-14T22:16:59.053Z",
  "executiveSummary": "ZFile versions through 5.0.5 contain a critical path traversal vulnerability within the download endpoint. The flaw arises from insufficient validation of user-supplied file paths in the context of share links, allowing an attacker to escape the restricted base directory.\nThis vulnerability is classified as an improper limitation of a pathname to a restricted directory (Path Traversal). By manipulating query parameters, an unauthorized actor can access and download arbitrary files located anywhere within the application's underlying filesystem reach, provided the process has read permissions.\nThe risk is high, as it enables sensitive data exfiltration, including configuration files, system logs, or user data, without requiring prior authentication beyond the possession of a valid share link. This exposure compromises the confidentiality of the entire shared storage environment and potentially the host system.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the ZFile download endpoint to implement canonicalization and boundary validation for user-provided file paths. When a user interacts with a share link, the application logic fails to verify that the path parameter supplied in the query string is explicitly contained within the authorized root directory assigned to that specific share.\nThe exploitation process follows a predictable pattern: an attacker obtains a valid share link, which serves as the entry point. By intercepting the download request or manually crafting a URL, the attacker appends a path traversal sequence (such as '../') to the file query parameter. Because the application logic trusts the user input without performing a secure path verification—such as checking if the absolute path of the requested file starts with the intended base directory—the backend process resolves the path relative to the root filesystem or outside the intended share scope.\nThe attack flow proceeds as follows: 1) The attacker identifies the download endpoint associated with a share. 2) The attacker crafts a request containing a modified path parameter designed to navigate outside the sandbox. 3) The server-side code processes the request, resolves the malicious path, and reads the target file from the disk. 4) The server streams the contents of the unauthorized file back to the attacker as a download response.\nThis vulnerability is present in all ZFile versions through 5.0.5. It does not require administrative privileges or complex authentication; possession of a publicly accessible or known share link is sufficient to initiate the exploit. The exposure is network-based, targeting the web interface directly. Post-exploitation impact is limited only by the filesystem permissions of the account running the ZFile process, potentially allowing for the retrieval of sensitive environment configuration files or internal metadata that could lead to further system compromise."
}