# github.com/mickael-kerjean/filestash (Go) vulnerabilities 3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v0.2.1 (Jun 27, 2018): affected by 3 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 1 since v0.2.1 (Jun 27, 2018) - Registry: https://pkg.go.dev/github.com/mickael-kerjean/filestash - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-50891: v0.2.1 (through the newest release) - CVE-2024-41256: v0.2.1 (through the newest release) - CVE-2024-41255: v0.2.1 (through the newest release) ## Advisories (3) ### [CVE-2026-50891](https://cve.now/CVE-2026-50891): Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a… - Severity: High 8.1 - Published: Jun 15, 2026 - Affected: all versions; through 0.2.2-0.20260827111952-cbcd1e96ebc7. - No fix released. The latest release, v0.2.1, is still affected. ### [CVE-2024-41256](https://cve.now/CVE-2024-41256): Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate… - Severity: Medium 5.9 - Published: Jul 31, 2024 - Affected: through 0.4; all versions. - No fix released. The latest release, v0.2.1, is still affected. ### [CVE-2024-41255](https://cve.now/CVE-2024-41255): filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a… - Severity: High 7.5 - Published: Jul 31, 2024 - Affected: through 0.4; all versions. - No fix released. The latest release, v0.2.1, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/mickael-kerjean/filestash Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.