Executive brief
ZFile is an open-source online file sharing and management application that supports multiple storage backends (OneDrive, Google Drive, local storage, etc.). A vulnerability in versions through 5.0.5 allows attackers with a valid share link to download arbitrary files from the shared base directory by manipulating file path parameters, bypassing the intended access restrictions that should limit downloads to only the explicitly shared files.
Technical details
The vulnerability is a path traversal/arbitrary file access flaw in the share link download endpoint. The vulnerable component (ShareLinkFileService.java) fails to properly validate that requested file paths are within the set of files explicitly permitted for the given share link. An attacker holding a valid share link can supply arbitrary file paths as query parameters to the download endpoint to access any file under the shared base directory. No authentication beyond possession of the share link is required. The attack is network-accessible and requires only knowledge of a valid share link URL. Patches addressing path validation are expected in versions after 5.0.5.
Affected products
- zfile-dev ZFile through 5.0.5
Timeline
- 2026-09-14: disclosed