Skip to content
Threat Feed
Subscribe
high advisory

Foxel: Missing authentication and arbitrary file access (CVE-2026-121555)

Foxel versions through 2.4.0 contain a missing authentication vulnerability allowing unauthenticated remote attackers to bypass permission checks and retrieve arbitrary files or thumbnails via specific API endpoints.

CVE search metadata

CVE search record: CVE-2026-121555. Severity: high. CVSS: 7.5. KEV: no. Product: Foxel (<= 2.4.0). Brief: Foxel: Missing authentication and arbitrary file access (CVE-2026-121555). Brief link: https://feed.craftedsignal.io/briefs/2026-11-foxel-auth-bypass/

Triage facts

Revision 1
Applicability
Foxel (<= 2.4.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 3, 18:01 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

Foxel versions 2.4.0 and earlier are vulnerable to a missing authentication flaw affecting the /api/fs/stream and /api/fs/thumb endpoints. Unauthenticated attackers can exploit this by providing a VFS mount prefix and a relative path, effectively bypassing PathRule permission restrictions. This allows the retrieval of full file contents and thumbnails from the system.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files and thumbnails across all VFS mounts, leading to unauthorized information disclosure and potential exposure of sensitive configuration or data stored within the Foxel instance.

Recommendation

  • Identify all internet-facing instances of Foxel version 2.4.0 or earlier.
  • Restrict access to the /api/fs/stream and /api/fs/thumb endpoints at the perimeter firewall or reverse proxy level until a vendor-supplied patch is applied.
  • Implement monitoring on web server logs to detect unauthorized requests to the identified API endpoints originating from non-trusted IP addresses.

Immediate actions

Scan network for internet-facing Foxel instances.

SOC 24h

Mitigations

Implement WAF rules to block requests to /api/fs/stream and /api/fs/thumb from external IPs.

immediate IT Operations

CVE-2026-121555

Detection coverage 1

Detect Potential CVE-2026-121555 Exploitation - Unauthenticated File Access

high

Detects attempts to access Foxel file stream or thumbnail endpoints by unauthenticated users, which may indicate exploitation of CVE-2026-121555.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →