CVE-2026-30942 Details
Description
Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to 1.7.3, an authenticated path traversal vulnerability in /api/avatars/[filename] allows any logged-in user to read arbitrary files from within the application container. The filename URL parameter is passed to path.join() without sanitization, and getFileStream() performs no path validation, enabling %2F-encoded ../ sequences to escape the uploads/avatars/ directory and read any file accessible to the nextjs process under /app/. Authentication is enforced by Next.js middleware. However, on instances with open registration enabled (the default), any attacker can self-register and immediately exploit this. This vulnerability is fixed in 1.7.3.
A path traversal vulnerability has been identified in the FlintSH Flare file sharing platform, specifically in versions prior to 1.7.3. The vulnerability allows authenticated users to read arbitrary files from the application container via the '/api/avatars/[filename]' endpoint. The issue arises because the 'filename' URL parameter is passed to 'path.join()' without proper sanitization, and the 'getFileStream()' function lacks path validation. This oversight enables '%2F'-encoded '../' sequences to escape the 'uploads/avatars/' directory, accessing any file under '/app/' that is readable by the Next.js process. While authentication is enforced by Next.js middleware, instances with open registration enabled (the default) can be exploited by any self-registered user.
Users can update to Flare version 1.7.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlintSH/Flare/commit/cd894cc480619aef958be5de72b1445222fd8d36 | [email protected] | Patch |
| https://github.com/FlintSH/Flare/releases/tag/v1.7.3 | [email protected] | ProductRelease Notes |
| https://github.com/FlintSH/Flare/security/advisories/GHSA-h639-p7m9-mpgp | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flintsh flare | < 1.7.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |