CVE-2026-112240

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An unauthenticated attacker can access files uploaded by other visitors because the download link for files uploaded via a form uses a predictable token. Furthermore, the file name in the request is not verified against guessing. The token is also exposed in plain text within the text version of notification emails.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.