Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-f72r-2h5j-7639

HighCVSS 7.5 / 10
Published Jan 28, 2026·Last modified Feb 10, 2026
Affected Components(0)

No affected components available

Description

File Read Interface Case Bypass Vulnerability

Vulnerability Name

File Read Interface Case Bypass Vulnerability

Overview

The /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case paths and read protected configuration files.

Impact

  • Read sensitive information in configuration files (e.g., access codes, API Tokens, sync configurations, etc.).
  • Remotely exploitable directly when the service is published without authentication.

Trigger Conditions

  • Running on a case-insensitive file system.
  • The caller can access /api/file/getFile (via CheckAuth or Token injection in published services).

PoC (Generic Example)

After enabling publication:

Request:

POST /api/file/getFile
Content-Type: application/json

{"path":"cOnf/conf.json"}

Expected Result:

  • Successfully return the content of the configuration file.

Root Cause

Path comparison uses strict case-sensitive string matching, without case normalization or identical file validation.

Fix Recommendations

  • Normalize path casing before comparison (Windows/macOS).
  • Use file-level comparison methods such as os.SameFile.
  • Apply blacklist validation on sensitive paths after case normalization.

Notes

  • Environment identifiers and sensitive information have been removed.

Solution Commit

399a38893e8719968ea2511e177bb53e09973fa6

Risk Scores
Base Score
7.5

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information.

Threat Intelligence
6.9

Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.

EPSS
0.51%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

High severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard