CVE-2026-51026 Details

A directory traversal vulnerability has been identified in FileThingie version 2.5.7. This vulnerability allows authenticated remote attackers to read arbitrary files on the server by exploiting improper input sanitization. The issue arises when the application attempts to clean user input in the `$_REQUEST` superglobal but fails to adequately sanitize the `$_GET` superglobal, which is ultimately used in file handling operations. As a result, attackers can craft requests that bypass the sanitization process and access sensitive files through the file download functionality.

To address this vulnerability, it is recommended to avoid using `$_GET` directly after sanitizing `$_REQUEST`. Instead, assign sanitized inputs to local variables and use those variables throughout the controller logic. Additionally, implement `basename()` on the file parameter to ensure that only specific files are targeted, stripping away any directory traversal characters.