In-app reader

Filestash allows attackers to escalate privileges via sending a crafted request

GitHub AdvisoriesJune 15, 2026Sign in to save

advisory github CVE-2026-50891 high

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.

Discussion

Comments

Sign in to join the discussion.

No comments yet — start the thread.

Keep reading

More on Bugflare

WriteupMonetizing Bug Bounty Skills Beyond Platform PayoutsTurn hunting craft into consulting, retainers, training, and productized services without burning bridges or violating program NDAs.
WriteupWhen to Stop Hunting a Target (Before It Stops You)Recognize dead programs, saturated surfaces, and personal skill mismatches early — and walk away without guilt so the next target gets your best hours.
WriteupTimeboxing Targets: A Productivity System for Bug BountyGive each program a fixed hunt window, decide go/no-go with hard signals, and stop sinking weeks into assets that will not pay.
WriteupA Note-Taking System for Bug Bounty Hunters That Survives ChaosCapture targets, endpoints, and half-finished threads in a system you will actually reopen next week — without turning notes into a second full-time job.
WriteupBuilding a Bug Bounty Lab at Home Without Breaking the BankStand up a practical hunter lab: isolated VMs, proxy tooling, intentionally vulnerable apps, and safe defaults that keep your home network out of scope.

Filestash allows attackers to escalate privileges via sending a crafted request · Bugflare