Path Traversal Vulnerability in ZFile Download Endpoint

ZFile, a popular file directory software, contains a critical path traversal vulnerability (CVE-2026-91144) in versions through 5.0.5. The vulnerability resides within the download endpoint, which fails to adequately validate user-supplied file paths against the base directory defined for a specific share link. An attacker who possesses a valid share link can manipulate query parameters to access and retrieve files outside of the intended, restricted directory. This flaw effectively grants unauthorized read access to the underlying server filesystem, potentially leading to the exposure of sensitive configuration files, environment variables, or other private data stored on the host. The issue is exacerbated by the fact that the endpoint does not require authentication, making it accessible to any party with a public share link. Defenders should prioritize updating ZFile to a patched version once available and monitor access logs for anomalous path structures.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass directory restrictions and exfiltrate arbitrary files from the server. This could lead to full system information disclosure, including compromise of credentials or system configuration, depending on the server's permissions.

Recommendation

• Upgrade all instances of ZFile to a version newer than 5.0.5 immediately upon release of a security patch.
• Deploy the provided Sigma rule to monitor for path traversal attempts targeting the ZFile download endpoint.
• Configure web application firewalls to alert on requests containing sequences such as "../" or "..\" in query parameters directed at ZFile download handlers.