CVE-2026-71518

Name of the Vulnerable Software and Affected Versions Typemill versions prior to 2.26.0

Description An authorization bypass exists in the media file download route. Unauthenticated attackers can access restricted files by submitting path-equivalent URL variants. By using normalized path forms, such as dot-slash prefixes, double slashes, or percent-encoded sequences, attackers can bypass role-based restriction checks. This occurs because the filesystem resolves the request to the protected file despite the security checks, allowing unauthorized file downloads without credentials.

Recommendations Update Typemill to version 2.26.0 or later.