GoPackage

github.com/mickael-kerjean/filestash

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: v0.2.1 (Jun 27, 2018): affected by 3 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 2 high, 1 medium

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-50891High 8.1
Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a…
Affected: all versions; through 0.2.2-0.20260827111952-cbcd1e96ebc7.
No fix released. The latest release, v0.2.1, is still affected.
CVE-2024-41256Medium 5.9
Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate…
Affected: through 0.4; all versions.
No fix released. The latest release, v0.2.1, is still affected.
CVE-2024-41255High 7.5
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a…
Affected: through 0.4; all versions.
No fix released. The latest release, v0.2.1, is still affected.