Foxel vulnerabilities

CVEs whose affected-version data names the Foxel package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-121555High· 7.5

5d ago

Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative pa…

▾ TwilightDrizzleTime · FoxelEPSS 0.58%via CVEORG