CVE-2026-52100: Andreimarcu linx-server CSRF Vulnerability

CVE-2026-52100 Overview

CVE-2026-52100 is a Cross-Site Request Forgery (CSRF) vulnerability affecting andreimarcu linx-server versions 1.0 through 2.3.8. The flaw resides in the uploadPutHandler function, which processes file upload requests without validating the origin of the request. A remote attacker can craft a malicious page that, when visited by an authenticated user, forces the browser to submit forged upload requests. Successful exploitation allows arbitrary file uploads that can lead to arbitrary code execution on the affected server. The weakness is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
Attackers can force authenticated users to upload arbitrary files through the uploadPutHandler endpoint, resulting in arbitrary code execution on the linx-server instance.

Affected Products

andreimarcu linx-server version 1.0
andreimarcu linx-server versions 1.x through 2.3.7
andreimarcu linx-server version 2.3.8

Discovery Timeline

2026-07-14 - CVE-2026-52100 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-52100

Vulnerability Analysis

The vulnerability exists in the uploadPutHandler function of linx-server, a self-hosted file and media sharing application written in Go. The handler accepts HTTP PUT requests for file uploads but does not enforce anti-CSRF protections such as origin validation, referer checking, or synchronizer tokens. Because browsers automatically attach session cookies to cross-origin requests, an attacker-controlled page can trigger uploads on behalf of an authenticated user without their consent.

The upload path processes the request body directly and writes the resulting file to the server's storage. When combined with linx-server's file rendering and script-execution behavior, an attacker-supplied payload can be executed in the context of the server or its users, escalating the CSRF into arbitrary code execution.

Root Cause

The root cause is missing request-origin verification within uploadPutHandler. State-changing operations must be authenticated by more than session cookies alone. Without a per-request CSRF token or strict SameSite cookie enforcement, any authenticated session can be abused by a third-party site to perform uploads.

Attack Vector

Exploitation requires network access to the linx-server instance and a victim with an active session or upload permissions. The attacker hosts a webpage that issues a cross-origin PUT request containing the malicious file body to the linx-server upload endpoint. When the victim loads the attacker's page, the browser transmits the forged request with the victim's credentials, and the server accepts the upload. Technical details are documented in the community vulnerability report on GitHub.

No verified public exploit code is available. The vulnerability mechanism is described in the linked report referencing the linx-server source repository.

Detection Methods for CVE-2026-52100

Indicators of Compromise

Unexpected files appearing in the linx-server upload directory that were not initiated by legitimate users.
HTTP PUT requests to the linx-server upload endpoint with Origin or Referer headers pointing to unrelated external domains.
Uploads occurring outside normal user activity windows or from user sessions that show no corresponding client-side upload actions.

Detection Strategies

Inspect reverse proxy and web server logs for PUT requests to upload paths whose Referer or Origin does not match the linx-server hostname.
Correlate authenticated session activity with upload events to identify uploads triggered without a preceding UI navigation.
Enable file integrity monitoring on the linx-server storage directory to detect unauthorized additions.

Monitoring Recommendations

Forward web server and application logs to a centralized log analytics or SIEM platform and alert on cross-origin upload activity.
Monitor for newly uploaded files with executable content types (HTML, SVG, script) that could enable follow-on code execution.
Track authentication events alongside upload events to identify session abuse patterns.

How to Mitigate CVE-2026-52100

Immediate Actions Required

Upgrade linx-server to a version later than 2.3.8 once a patched release is available from the upstream repository.
Restrict access to the linx-server instance behind authentication and network controls until a fix is applied.
Audit the upload directory for unauthorized files and remove any that cannot be attributed to legitimate user activity.

Patch Information

No official vendor patch reference is listed in the NVD entry at the time of publication. Monitor the linx-server GitHub repository for a fixed release addressing the missing CSRF protections in uploadPutHandler.

Workarounds

Place linx-server behind a reverse proxy that rejects PUT requests lacking a matching Origin or Referer header for the linx-server hostname.
Enforce SameSite=Strict on session cookies to prevent browsers from attaching them to cross-origin requests.
Require an additional authentication factor or API key for upload endpoints and disable anonymous or session-only uploads.

bash

# Example nginx reverse-proxy rule enforcing same-origin PUT uploads
location /upload/ {
    if ($request_method = PUT) {
        set $csrf_ok 0;
        if ($http_origin = "https://linx.example.com") { set $csrf_ok 1; }
        if ($csrf_ok = 0) { return 403; }
    }
    proxy_pass http://127.0.0.1:8080;
}