CyberRota Analysis
AI-GeneratedZFile versions up to 5.0.5 are vulnerable due to inadequate validation of file paths on the download endpoint, allowing attackers with a share link to exploit this flaw and download arbitrary files within the shared base directory. This vulnerability poses a significant risk of unauthorized data access, making it critical for organizations using ZFile to prioritize immediate remediation. Users of affected versions should assess their exposure and implement necessary security measures to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.