Foxel (<= 2.4.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/foxel--2.4.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 18:01:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFoxel: Missing authentication and arbitrary file access (CVE-2026-121555)https://feed.craftedsignal.io/briefs/2026-11-foxel-auth-bypass/Tue, 03 Nov 2026 18:01:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-foxel-auth-bypass/Foxel versions through 2.4.0 contain a missing authentication vulnerability allowing unauthenticated remote attackers to bypass permission checks and retrieve arbitrary files or thumbnails via specific API endpoints.Foxel versions 2.4.0 and earlier are vulnerable to a missing authentication flaw affecting the /api/fs/stream and /api/fs/thumb endpoints. Unauthenticated attackers can exploit this by providing a VFS mount prefix and a relative path, effectively bypassing PathRule permission restrictions. This allows the retrieval of full file contents and thumbnails from the system.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files and thumbnails across all VFS mounts, leading to unauthorized information disclosure and potential exposure of sensitive configuration or data stored within the Foxel instance.

Recommendation

  • Identify all internet-facing instances of Foxel version 2.4.0 or earlier.
  • Restrict access to the /api/fs/stream and /api/fs/thumb endpoints at the perimeter firewall or reverse proxy level until a vendor-supplied patch is applied.
  • Implement monitoring on web server logs to detect unauthorized requests to the identified API endpoints originating from non-trusted IP addresses.
]]>highadvisoryauthentication-bypassfile-accesswebserver