Filestash allows attackers to escalate privileges via sending a crafted request

HOCH 8.1CVE-2026-50891 · GHSA-rcqf-cpv9-g5jf · GO-2026-6300 · Published 15/06/2026 · updated 17/06/2026

Kurz gesagt

CVE-2026-50891 ist eine Schwachstelle (HOCH (CVSS 8.1)) in github.com/mickael-kerjean/filestash.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.33%, höher als bei 25.8% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
github.com/mickael-kerjean/filestash Go	`≤ 0.2.2-0.20260827111952-cbcd1e96ebc7all versions`	No fix yet

Description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

NVD description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

References

nvd.nist.gov/vuln/detail/CVE-2026-50891 · ADVISORY
gist.github.com/pyuysig/50dc365f54f95396bb67532f02b34bb0 · WEB
mickael-kerjean/filestash · PACKAGE
GitHub Advisory GHSA-rcqf-cpv9-g5jf · ADVISORY

Weitere Schwachstellen in github.com/mickael-kerjean/filestash

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/mickael-kerjean/filestash

≤ 0.2.2-0.20260827111952-cbcd1e96ebc7all versions

No fix yet

Description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

NVD description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

Weitere Schwachstellen in github.com/mickael-kerjean/filestash

Alle anzeigen →