CVE-2026-91144: ZFile Path Traversal Vulnerability

CVE-2026-91144 Overview

CVE-2026-91144 is a broken access control vulnerability [CWE-639] in ZFile through version 5.0.5. The application's download endpoint fails to validate requested file paths against the allowed entries defined by a share link. An attacker holding a valid share link can pass arbitrary file paths as query parameters and download any file located under the shared base directory, bypassing the intended per-entry access restrictions.

Critical Impact
Any recipient of a ZFile share link can retrieve files outside the explicitly shared entries, exposing sensitive content stored beneath the shared base directory.

Affected Products

ZFile file management platform, all releases through 5.0.5
Deployments exposing the share download endpoint to untrusted users
Instances distributing share links that reference specific file subsets rather than the entire base directory

Discovery Timeline

2026-09-14 - CVE-2026-91144 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91144

Vulnerability Analysis

ZFile allows administrators to create share links that expose either an entire base directory or a curated set of entries within it. The download endpoint, implemented in ShareLinkFileService.java, enforces the share link token but does not re-check whether the requested path belongs to the share's allowed entry list.

When a user requests a download, the service resolves the supplied path relative to the share's base directory and streams the resulting file. Because the allowed-entries filter is not applied on this code path, restricted shares behave identically to fully open shares once the token is known.

This is an authorization flaw rather than a path traversal issue. Attackers do not need to escape the base directory. They only need to reference sibling files or subdirectories that were intentionally omitted from the share definition.

Root Cause

The root cause is missing authorization on a per-object basis, mapped to [CWE-639] (Authorization Bypass Through User-Controlled Key). The download handler trusts the file path parameter without verifying that the resolved object matches one of the entries the share link is permitted to serve.

Attack Vector

Exploitation requires network access to the ZFile instance and possession of a share link, but no authentication or user interaction. An attacker crafts a request to the share download endpoint and substitutes the file path query parameter with the relative path of any file under the shared base directory. The server returns the file contents even when the path is not part of the share's declared entries. Technical details are documented in the VulnCheck Advisory for ZFile and the corresponding GitHub Issue #826.

Detection Methods for CVE-2026-91144

Indicators of Compromise

Share download requests where the file path query parameter references entries not present in the share's configured allow list.
Successful downloads from share tokens for filenames that were never explicitly shared.
Bursts of sequential download requests against a single share link enumerating multiple file paths under the same base directory.

Detection Strategies

Correlate share link identifiers against the entries defined at share creation and alert when downloaded paths fall outside that set.
Baseline expected download volume per share link and flag deviations that suggest enumeration of the base directory.
Review application logs from the ShareLinkFileService component for repeated 200-response downloads tied to a single share token but varying paths.

Monitoring Recommendations

Enable verbose access logging on the ZFile share download endpoint, capturing the share ID, requested path, and source IP.
Forward ZFile access logs to a centralized analytics platform for retention and cross-share correlation.
Monitor egress bandwidth from the ZFile host for spikes that could indicate bulk exfiltration through a leaked share link.

How to Mitigate CVE-2026-91144

Immediate Actions Required

Restrict network exposure of ZFile instances running version 5.0.5 or earlier until a patched build is deployed.
Revoke and reissue any share links that reference selective entries rather than an entire directory, since the entry filter cannot be trusted on affected versions.
Audit the contents of directories used as share bases and relocate sensitive files that were assumed to be non-shared.

Patch Information

No fixed version was listed in the NVD record at publication. Monitor the GitHub ZFile Repository and GitHub Issue #826 for the upstream fix, and review the vulnerable handler in ShareLinkFileService.java to confirm remediation once released.

Workarounds

Share only directories whose entire contents are safe for the intended recipients, avoiding partial-entry shares on affected versions.
Place ZFile behind an authenticating reverse proxy so share URLs cannot be accessed by unauthenticated internet users.
Segregate sensitive files into separate base directories that are never used as the root of a share link.

bash

# Example: block public access to the share download endpoint at the reverse proxy
# (nginx) until an upstream patch is applied
location ~ ^/api/share/.*/download {
    allow 10.0.0.0/8;
    deny  all;
}