CVE-2026-30942: Flare Path Traversal Vulnerability

CVE-2026-30942 Overview

CVE-2026-30942 is a path traversal vulnerability affecting Flare, a Next.js-based self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.3, an authenticated path traversal flaw in the /api/avatars/[filename] endpoint allows any logged-in user to read arbitrary files from within the application container. The vulnerability exists because the filename URL parameter is passed to path.join() without sanitization, and getFileStream() performs no path validation. This enables attackers to use %2F-encoded ../ sequences to escape the uploads/avatars/ directory and read any file accessible to the Next.js process under /app/.

Critical Impact

Authenticated attackers can read sensitive files including configuration files, environment variables, and application source code from the container, potentially exposing secrets, database credentials, and other sensitive information. On instances with open registration enabled (the default configuration), any attacker can self-register and immediately exploit this vulnerability.

Affected Products

• Flare file sharing platform versions prior to 1.7.3
• Self-hosted Flare instances with open registration enabled (default configuration)
• Containerized deployments running Flare under the /app/ directory

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-30942 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30942

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), which occurs when user-supplied input is used to construct file paths without proper validation or sanitization. The flaw allows authenticated users to break out of the intended uploads/avatars/ directory and access arbitrary files within the application container's filesystem.

The authentication requirement is partially mitigated by Flare's default configuration, which enables open registration. This means any attacker can create an account and immediately gain the necessary authentication to exploit the vulnerability. The impact is significant as attackers can potentially access sensitive configuration files, environment variables containing secrets, database credentials, and application source code.

Root Cause

The root cause is improper input validation in the avatar file retrieval API endpoint. The filename parameter from the URL is directly passed to path.join() without any sanitization to remove or neutralize directory traversal sequences. Additionally, the getFileStream() function performs no validation to ensure the resolved path remains within the intended uploads/avatars/ directory boundary. This combination allows URL-encoded path traversal sequences (%2F for / and .. for parent directory) to escape the designated upload directory.

Attack Vector

The attack is network-based and requires low-privileged access (any authenticated user). An attacker first authenticates to the Flare instance—either using existing credentials or by self-registering if open registration is enabled (the default). The attacker then crafts a malicious request to the /api/avatars/[filename] endpoint, encoding path traversal sequences using URL encoding to bypass basic input filters. For example, ..%2F represents ../ after URL decoding, allowing the attacker to traverse up the directory tree.

By chaining multiple ..%2F sequences, the attacker can navigate from uploads/avatars/ up to the container root and then access any file readable by the Next.js process, such as /app/.env, /app/package.json, or other sensitive application files.

The vulnerability mechanism involves the following flow: The filename parameter containing encoded traversal sequences (e.g., ..%2F..%2F..%2F.env) is passed to path.join(), which resolves the path to a location outside the intended directory. The getFileStream() function then opens and returns the file contents without verifying the path is within allowed boundaries. For additional technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-30942

Indicators of Compromise

• HTTP requests to /api/avatars/ containing URL-encoded path traversal sequences such as %2F, ..%2F, or %2e%2e
• Access logs showing requests for avatar filenames with unusual patterns like ....// or multiple consecutive dots
• Unexpected file access events in application logs referencing files outside the uploads/avatars/ directory
• Server responses containing content that matches known sensitive file patterns (environment variables, configuration files)

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block URL-encoded path traversal patterns in the /api/avatars/ endpoint
• Monitor application and web server access logs for requests containing .., %2e, or %2f sequences in avatar filename parameters
• Deploy file integrity monitoring on sensitive files within the container to detect unauthorized read attempts
• Configure SentinelOne Singularity Platform to detect anomalous file access patterns from the Next.js process

Monitoring Recommendations

• Enable detailed access logging for the /api/avatars/ API endpoint to capture full request paths
• Set up alerts for any requests to the avatar endpoint that contain path traversal indicators
• Monitor for unusual patterns of user registrations followed by immediate API access attempts
• Implement rate limiting and anomaly detection for avatar endpoint requests per authenticated session

How to Mitigate CVE-2026-30942

Immediate Actions Required

• Upgrade Flare to version 1.7.3 or later immediately to address this vulnerability
• If upgrade is not immediately possible, disable open registration to limit attacker access
• Review access logs for any evidence of exploitation attempts against the /api/avatars/ endpoint
• Rotate any secrets or credentials that may have been exposed if exploitation is suspected

Patch Information

The vulnerability has been fixed in Flare version 1.7.3. The security fix is available in commit cd894cc480619aef958be5de72b1445222fd8d36. Administrators should upgrade to the patched version by pulling the latest release from the official Flare GitHub repository. For detailed information about the fix, refer to the GitHub commit and the GitHub Security Advisory GHSA-h639-p7m9-mpgp.

Workarounds

• Disable open registration in Flare settings to prevent unauthorized users from gaining authenticated access required for exploitation
• Implement a reverse proxy or WAF rule to filter requests containing path traversal patterns before they reach the Flare application
• Restrict network access to the Flare instance to trusted IP ranges only until patching is complete
• Consider temporarily disabling the avatar functionality if the above workarounds cannot be implemented

# Example: Nginx location block to filter path traversal attempts
location /api/avatars/ {
    # Block requests containing encoded path traversal sequences
    if ($request_uri ~* "(%2e|%2f|\.\.)" ) {
        return 403;
    }
    proxy_pass http://flare_backend;
}