PT-2026-2367 · Unknown · Owlfiles File Manager

Chokri Hammedi · Published 2026-01-13 · Updated 2026-02-02 · CVE-2022-50891

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Owlfiles File Manager version 12.0.1

Description Owlfiles File Manager contains a cross-site scripting issue that enables attackers to inject malicious scripts. This is achieved by exploiting the path parameter within HTTP server endpoints, specifically the download and list endpoints. Attackers can construct URLs with embedded script tags to execute arbitrary JavaScript in the browsers of users. The vulnerable parameter is path. The affected API endpoints are the download and list endpoints.

Recommendations Apply any available updates to address this issue. As a temporary workaround, consider sanitizing the path parameter to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-50891

Affected Products

Owlfiles File Manager

References · 8

• 🔥 https://exploit-db.com/exploits/51036 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50891 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50891 · Vendor Advisory
• https://skyjos.com · Note
• https://vulncheck.com/advisories/owlfiles-file-manager-cross-site-scripting-via-http-server · Note
• https://twitter.com/CVEnew/status/2011759636362244319 · Twitter Post
• https://apps.apple.com/us/app/owlfiles-file-manager/id510282524 · Note
• https://t.me/cveNotify/150590 · Telegram Post