Information Disclosure in FileThingie v2.5.7

Executive Summary

CVE-2026-51027 is a critical vulnerability in FileThingie v2.5.7, an open-source file management tool. It involves a path traversal flaw called 'Slash Inflation' where authenticated users with low privileges can write or move files outside the intended directory. The issue stems from incorrect slash counting in user-supplied paths, allowing attackers to bypass intended restrictions and access sensitive locations.

Useful 0 Not Useful 0

Detection Guidance

Check FileThingie version 2.5.7 for the 'Slash Inflation' path traversal flaw. Test by submitting long slash sequences in the dir parameter and ../ in newvalue to see if files can be moved outside the intended directory. Monitor for unauthorized file writes or moves to restricted locations like /tmp or web-accessible directories.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to upload malicious files like PHP web shells, overwrite system files, or execute arbitrary code. If administrators disable password protection, it can be exploited without authentication, turning it into a zero-click attack. This could lead to full system compromise, data theft, or unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Replace the flawed slash-counting logic with PHP's realpath() function for proper path canonicalization. Sanitize user input to remove redundant slashes early in processing. Ensure password protection is enabled in config.php to prevent unauthenticated access. Update to a patched version of FileThingie if available.

Useful 0 Not Useful 0