| Package | Affected versions | Patched versions |
|---|---|---|
| No affected product versions are listed for this vulnerability yet. | ||
Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free