CVE-2026-121555

{
  "etk_id": "ETK-2026-3380",
  "cve_id": "CVE-2026-121555",
  "display_id": "CVE-2026-121555",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-115900",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated file read in Foxel",
  "summary": "Foxel through 2.4.0 exposes file streaming and thumbnail functionality without required authentication. An unauthenticated attacker able to reach the affected endpoints can read file contents or thumbnails from VFS mounts despite configured path permission rules.",
  "mitigation": "Restrict or disable access to the affected file streaming and thumbnail endpoints, allowing only authenticated and trusted clients. Limit network exposure to Foxel until a fixed release is available; no fixed version is recorded in the advisory.",
  "vendor": "DrizzleTime",
  "product": "Foxel",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.4.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Foxel",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 13.658084433333332,
  "t0_at": "2026-11-03T15:17:12.866000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-03T16:12:47.258109+00:00",
      "days": 0.038592501261574076,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T15:17:12.866000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-03T15:17:12.866000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T15:17:12.866000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-121555"
    }
  }
}