Foxel allows unauthenticated file reads

Anyone can read files in a file manager without logging in.

Summary

Foxel through 2.4.0 has missing authentication on the /api/fs/stream and /api/fs/thumb endpoints. An unauthenticated attacker can read full files and thumbnails across all mounts, bypassing PathRule permissions.

What to do

Check that you run a version newer than 2.4.0 and read the vulncheck advisory. No fixed version is named in the sources.

Products and platforms

Foxel

CVE IDs

CVE-2026-121555 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 15:17 UTC

First seen 2026-11-09 14:50 UTC