Authorization Bypass in Typemill Media File Download Route

Typemill versions before 2.26.0 contain a critical authorization bypass vulnerability (CVE-2026-71518) located within the media file download route. The flaw originates from the application's failure to properly normalize input parameters before executing role-based access control (RBAC) checks. An unauthenticated attacker can exploit this weakness by submitting specifically crafted, path-equivalent URL variants to the target media download endpoint. By utilizing techniques such as dot-slash prefixes, double slashes, or percent-encoded sequences, an attacker can manipulate the request to bypass authentication logic. Once the authorization check is circumvented, the underlying filesystem resolves the path to the intended restricted file, facilitating unauthorized retrieval of sensitive media content without requiring credentials.

Impact

Successful exploitation of this vulnerability allows unauthorized users to access and download files hosted within Typemill instances that were intended to be restricted. This potentially exposes sensitive media, private documents, or configuration data stored in the media directory, leading to unauthorized information disclosure.

Recommendation

• Upgrade all Typemill instances to version 2.26.0 or higher immediately to apply the patch for CVE-2026-71518.
• Audit access logs for anomalous requests to media download endpoints containing characters such as '.', '/', and '%', which may indicate attempted path manipulation.
• Implement stricter input validation and normalization at the web server or application firewall level for all incoming requests targeting file retrieval routes.