Filestash allows attackers to escalate privileges via sending a crafted request

HIGH 8.1CVE-2026-50891 · GHSA-rcqf-cpv9-g5jf · GO-2026-6300 · Published 15/06/2026 · updated 17/06/2026

In short

CVE-2026-50891 is a HIGH (CVSS 8.1) vulnerability affecting github.com/mickael-kerjean/filestash.
Chance of exploitation in the next 30 days (EPSS): 0.33%, higher than 25.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
github.com/mickael-kerjean/filestash Go	`≤ 0.2.2-0.20260827111952-cbcd1e96ebc7all versions`	No fix yet

Description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

NVD description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

References

nvd.nist.gov/vuln/detail/CVE-2026-50891 · ADVISORY
gist.github.com/pyuysig/50dc365f54f95396bb67532f02b34bb0 · WEB
mickael-kerjean/filestash · PACKAGE
GitHub Advisory GHSA-rcqf-cpv9-g5jf · ADVISORY

More vulnerabilities in github.com/mickael-kerjean/filestash

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/mickael-kerjean/filestash

≤ 0.2.2-0.20260827111952-cbcd1e96ebc7all versions

No fix yet

Description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

NVD description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

More vulnerabilities in github.com/mickael-kerjean/filestash

See all →