CVE-2026-51027
FileThingie version 2.5.7 contains a flaw that lets a remote attacker read sensitive data through the ft2.php component. The vulnerability can be exploited over the network without any special privileges or user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users running FileThingie v2.5.7.
Real-world impact
An attacker who exploits this flaw can obtain confidential information stored by the application, potentially compromising all data handled by the system.
Why this severity
The CVSS score of 9.9 reflects that the attack can be performed over the network (AV:N), requires low effort (AC:L) and low privileges (PR:L), does not need user interaction (UI:N), and compromises confidentiality, integrity, and availability (C:H/I:H/A:H).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources