PT-2026-24251 · Flare · Flare

Ropshade · Publicado 2026-03-10 · Atualizado 2026-03-18 · CVE-2026-30942

Positive Technologies (AI Summary)

CVSS v4.0

8.3

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flare versions prior to 1.7.3

Description Flare is a Next.js-based, self-hostable file sharing platform. A path traversal issue exists in the /api/avatars/[filename] endpoint, allowing authenticated users to read arbitrary files within the application container. The filename URL parameter is passed to path.join() without proper sanitization, and the getFileStream() function does not validate the path. This enables the use of encoded ../ sequences to escape the uploads/avatars/ directory and access any file accessible to the Next.js process under /app/. Authentication is enforced by Next.js middleware, but open registration (the default setting) allows attackers to self-register and exploit the issue. The vulnerable parameter is filename.

Recommendations Update Flare to version 1.7.3 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-30942

GHSA-H639-P7M9-MPGP

Produtos afetados

Flare

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30942.json · Exploit
• https://github.com/FlintSH/Flare/security/advisories/GHSA-h639-p7m9-mpgp · Aviso do Fabricante
• https://github.com/FlintSH/Flare/releases/tag/v1.7.3 · Nota
• https://github.com/FlintSH/Flare/commit/cd894cc480619aef958be5de72b1445222fd8d36 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-30942 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-30942 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034136480314957963 · Publicação no Twitter