zfile-dev vulnerabilities

Products

• zfile 1

Latest zfile-dev CVEs

Newest publication first

1. CVE-2026-91144 ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint

   Published 2026-09-14

   High·CVSS 8.7

   ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the inten...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.