PT-2026-24251 · Flare · Flare

Ropshade · Published 2026-03-10 · Updated 2026-03-18 · CVE-2026-30942

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flare versions prior to 1.7.3

Description Flare is a Next.js-based, self-hostable file sharing platform. A path traversal issue exists in the /api/avatars/[filename] endpoint, allowing authenticated users to read arbitrary files within the application container. The filename URL parameter is passed to path.join() without proper sanitization, and the getFileStream() function does not validate the path. This enables the use of encoded ../ sequences to escape the uploads/avatars/ directory and access any file accessible to the Next.js process under /app/. Authentication is enforced by Next.js middleware, but open registration (the default setting) allows attackers to self-register and exploit the issue. The vulnerable parameter is filename.

Recommendations Update Flare to version 1.7.3 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-30942

GHSA-H639-P7M9-MPGP

Affected Products

Flare

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30942.json · Exploit
• https://github.com/FlintSH/Flare/security/advisories/GHSA-h639-p7m9-mpgp · Vendor Advisory
• https://github.com/FlintSH/Flare/commit/cd894cc480619aef958be5de72b1445222fd8d36 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-30942 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30942 · Vendor Advisory
• https://github.com/FlintSH/Flare/releases/tag/v1.7.3 · Note
• https://twitter.com/CVEnew/status/2034136480314957963 · Twitter Post