Loading story…
NitroShare Desktop through version 0.3.4 contains a high-severity path traversal flaw in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files outside the intended transfer directory. The issue stems from improper validation of crafted filenames supplied in the JSON item header name field, enabling ../ traversal sequences to target any location writable by the current user. Public reporting says the service listens on TCP port 40818 on all network interfaces by default, with TLS typically disabled, leaving transfers unauthenticated in common deployments.
The vulnerability is tracked as CVE-2026-66050 and has been described as remotely exploitable, with severity scores of 8.7 CVSS 4.0 and 7.5 CVSS 3.1. Advisories warn that attackers could place files in the Windows Startup folder to establish persistence and trigger code execution at the next user login, and a public proof-of-concept was reportedly validated against NitroShare 0.3.4 on Windows. The recommended mitigation is to upgrade to a version newer than 0.3.4 and monitor systems for unauthorized file writes.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Public advisories disclosed CVE-2026-66050 affecting NitroShare Desktop through version 0.3.4. The vulnerability allows unauthenticated attackers on the same network to write arbitrary files outside the transfer directory via a crafted filename in the LAN file transfer server, potentially enabling persistence or code execution.
A GitHub repository documented and demonstrated a path traversal vulnerability in NitroShare Desktop v0.3.4, including a proof-of-concept verified on Windows. The write-up described unauthenticated arbitrary file write via crafted ../ sequences in the LAN file transfer server's JSON item header.
The GitHub write-up states the author attempted responsible disclosure to the NitroShare developer three times during April and May 2026 but received no response.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Attackers are actively exploiting a zero-day vulnerability, CVE-2025-11371, in Gladinet CentreStack and TrioFox file-sharing and remote access platforms. This vulnerability is an unauthenticated local file inclusion (LFI) flaw that allows threat actors to access sensitive system files, including the application’s Web.config file. By retrieving the machine key from this configuration file, attackers can leverage a previously patched vulnerability, CVE-2025-30406, to achieve remote code execution (RCE) through ViewState deserialization attacks. Huntress, a cybersecurity firm, first detected exploitation of this flaw on September 26-27, 2025, and has confirmed that at least three customers have been impacted so far. The vulnerability affects all versions of CentreStack and TrioFox up to and including 16.7.10368.56560, and there is currently no official patch available from Gladinet. Both self-hosted and cloud-hosted deployments of these platforms are at risk, as the flaw impacts default installations and configurations. The exploitation chain involves using the LFI to extract the machine key, which is then used to craft malicious ViewState payloads that bypass integrity checks and enable arbitrary code execution on the server. Notably, Huntress observed successful exploitation even on systems that had already patched CVE-2025-30406, indicating that the previous fix was insufficient to fully mitigate the risk. In response, Huntress and other security experts recommend disabling the "temp" handler within the UploadDownloadProxy Web.config file as an immediate mitigation, though this may impact some platform functionality. Gladinet has acknowledged the vulnerability and its active exploitation but has not yet released a patch, urging customers to implement the recommended mitigations. The affected products are widely used by managed service providers, small businesses, and enterprises for secure file access and sharing, increasing the potential impact of this vulnerability. Attackers exploiting this flaw can gain full control over affected servers, leading to data theft, lateral movement, or further compromise of organizational networks. Security researchers are withholding some technical details to prevent further exploitation while a patch is developed. Organizations using CentreStack or TrioFox should urgently review their configurations and apply the recommended mitigations to reduce exposure. The incident highlights the risks associated with chained vulnerabilities and the importance of defense-in-depth strategies. Ongoing monitoring and threat detection are advised until a permanent fix is available. The situation remains fluid, with active exploitation continuing and the vendor working on a security update.
Jun 29, 2026
Citrix ShareFile StorageZones Controller versions before **5.11.24** are vulnerable to unauthenticated remote code execution tracked as **CVE-2023-24489**. The flaw affects the `/documentum/upload.aspx` endpoint, where a cryptographic weakness combined with path traversal can allow an unauthenticated attacker to upload arbitrary files into the webroot. An attacker could use the issue to deploy a web shell, execute commands on the StorageZones Controller host, and potentially pivot to other systems through lateral movement or privilege escalation. Organizations running self-managed ShareFile StorageZones Controller should upgrade to **5.11.24 or later** and investigate exposed or unpatched instances for suspicious uploads and web-shell activity.
Sep 3, 2026