Filestash allows attackers to escalate privileges via sending a crafted request

ALTO 8.1CVE-2026-50891 · GHSA-rcqf-cpv9-g5jf · GO-2026-6300 · Published 15/06/2026 · updated 17/06/2026

En resumen

CVE-2026-50891 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a github.com/mickael-kerjean/filestash.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.33%, mayor que el 25.8% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
github.com/mickael-kerjean/filestash Go	`≤ 0.2.2-0.20260827111952-cbcd1e96ebc7all versions`	No fix yet

Description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

NVD description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

References

nvd.nist.gov/vuln/detail/CVE-2026-50891 · ADVISORY
gist.github.com/pyuysig/50dc365f54f95396bb67532f02b34bb0 · WEB
mickael-kerjean/filestash · PACKAGE
GitHub Advisory GHSA-rcqf-cpv9-g5jf · ADVISORY

Más vulnerabilidades de github.com/mickael-kerjean/filestash

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/mickael-kerjean/filestash

≤ 0.2.2-0.20260827111952-cbcd1e96ebc7all versions

No fix yet

Description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

NVD description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

Más vulnerabilidades de github.com/mickael-kerjean/filestash

Ver todo →