Zfile-dev vulnerabilities
We track 1 vulnerability in Zfile-dev products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on September 14, 2026.
1vulnerabilities
0critical
1high
0exploited
7.5average CVSS score
Latest Zfile-dev vulnerabilities
- 7.5 High severity
zfile: Authorization Bypass Through User-Controlled Key
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory,