{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afoxelfoxel/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:foxel:foxel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-121555"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Foxel (\u003c= 2.4.0)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","file-access","webserver"],"_cs_type":"advisory","_cs_vendors":["Foxel"],"content_html":"\u003cp\u003eFoxel versions 2.4.0 and earlier are vulnerable to a missing authentication flaw affecting the /api/fs/stream and /api/fs/thumb endpoints. Unauthenticated attackers can exploit this by providing a VFS mount prefix and a relative path, effectively bypassing PathRule permission restrictions. This allows the retrieval of full file contents and thumbnails from the system.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to read arbitrary files and thumbnails across all VFS mounts, leading to unauthorized information disclosure and potential exposure of sensitive configuration or data stored within the Foxel instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all internet-facing instances of Foxel version 2.4.0 or earlier.\u003c/li\u003e\n\u003cli\u003eRestrict access to the /api/fs/stream and /api/fs/thumb endpoints at the perimeter firewall or reverse proxy level until a vendor-supplied patch is applied.\u003c/li\u003e\n\u003cli\u003eImplement monitoring on web server logs to detect unauthorized requests to the identified API endpoints originating from non-trusted IP addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T18:01:15Z","date_published":"2026-11-03T18:01:15Z","id":"https://feed.craftedsignal.io/briefs/2026-11-foxel-auth-bypass/","summary":"Foxel versions through 2.4.0 contain a missing authentication vulnerability allowing unauthenticated remote attackers to bypass permission checks and retrieve arbitrary files or thumbnails via specific API endpoints.","title":"Foxel: Missing authentication and arbitrary file access (CVE-2026-121555)","url":"https://feed.craftedsignal.io/briefs/2026-11-foxel-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:foxel:foxel:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}