Directory Traversal in FileThingie v2.5.7

Executive Summary

CVE-2026-51026 is a Directory Traversal vulnerability in FileThingie v2.5.7, an open-source PHP file manager. It allows authenticated users with low privileges to read arbitrary files on the server by exploiting improper input sanitization. The flaw occurs because the application sanitizes user input in $_REQUEST but later uses unsanitized $_GET values for file operations, enabling attackers to bypass restrictions and access sensitive files like /etc/passwd or configuration files.

The vulnerability arises from mixing superglobals where ft_sanitize_request() modifies $_REQUEST but fopen() uses raw $_GET['file'], allowing path traversal sequences (..) to bypass sanitization.

Useful 0 Not Useful 0

Detection Guidance

Check FileThingie logs for unusual file access patterns or requests containing '..' sequences. Use tools like curl to test for path traversal by sending crafted requests such as 'curl http://target/filethingie/download.php?file=../../../../etc/passwd'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files on the server, including system files like /etc/passwd, configuration files, or application data. Attackers with low privileges could escalate access to read restricted files, potentially exposing confidential information or credentials.

The impact includes full confidentiality loss as the web server user (e.g., www-data) can access any readable file on the system, posing significant security risks for affected deployments.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive personal or health data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage due to non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FileThingie to a patched version if available. If not, disable the application or restrict access to trusted users. Review and sanitize all file operations in the code, ensuring consistent use of sanitized variables instead of mixing superglobals like $_REQUEST and $_GET.

Useful 0 Not Useful 0