PT-2026-83401 · Unknown · Catfolders Document Gallery Pro
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Catfolders Document Gallery Pro versions prior to 2.0.7
Description
Certain REST API routes lack proper authorization, and the token used to identify requested content can be forged on the client side. This allows unauthenticated users to list and download the contents of folders that have not been published on the site. The issue specifically involves the
download-all functionality.Recommendations
Update Catfolders Document Gallery Pro to version 2.0.7 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Catfolders Document Gallery Pro