GitHub Advisoryadvisory · Go

GHSA-rcqf-cpv9-g5jf Filestash allows attackers to escalate privileges via sending a crafted request

HIGH Published 2026-06-15 Modified 2026-08-27 Official page ↗
Aliases
CVE-2026-50891
Ecosystem
Go
Packages
github.com/mickael-kerjean/filestash
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-284
Reviewed
2026-08-27

Affected packages

• Go github.com/mickael-kerjean/filestash: <= 0.2.2-0.20260827111952-cbcd1e96ebc7 (no fix yet)

Description

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

Related

Alias · CVE (1)

  • CVE-2026-50891 Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References