← Back to search

CVE-2026-112240

— UNSCORED

Published 2026-10-20 · Updated 2026-10-20

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.

Weaknesses

CWE-338, CWE-639

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.