Loading vulnerability…
CVE-2026-71518 is an authorization bypass vulnerability affecting Typemill versions before 2.26.0. The flaw exists in the media file download route, where role-based access restrictions are applied to requested file paths without sufficiently accounting for alternate but path-equivalent URL representations. By supplying normalized path variants such as dot-slash prefixes, duplicate slashes, or percent-encoded sequences, an unauthenticated attacker can cause the authorization logic to evaluate a manipulated path differently from how the filesystem ultimately resolves it. This discrepancy allows access checks to be bypassed and restricted media files to be downloaded without authentication.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small PoC for CVE-2026-71518 affecting Typemill versions prior to 2.26.0. It contains two files: a detailed README describing the vulnerability, root cause, attack chain, remediation, and usage; and a single Python exploit script at exploit/exploit.py that reproduces the issue end-to-end. The exploit targets Typemill's public media download route, GET /media/files/{params:.*}. The core bug is an authorization mismatch: Typemill checks role restrictions using the raw request path string, but reads the file using the filesystem-resolved path. Because path-equivalent variants such as ./, //, and %2e/ resolve to the same file on disk while not matching the restriction key exactly, an unauthenticated attacker can download files that were configured as role-restricted. The Python script is a local test harness rather than a generalized remote exploitation tool. It assumes a Docker container named typemill-test and a Typemill instance listening on http://localhost:8099. Using docker exec, it creates /var/www/html/media/files/secret.pdf containing a marker string and writes /var/www/html/media/files/filerestrictions.yaml to restrict that file to the editor role. It then performs a control request to /media/files/secret.pdf, expecting a 302 redirect indicating restriction enforcement, followed by requests to /media/files/./secret.pdf, /media/files//secret.pdf, and /media/files/%2e/secret.pdf. Success is determined by whether the secret marker string is returned in the response body. Capabilities are limited to proving unauthorized file disclosure; there is no code execution, shell payload, persistence, or post-exploitation logic. The repository is a legitimate proof-of-concept exploit, not merely a detector, because it actively triggers the authorization bypass and retrieves protected content. Overall maturity is POC: it demonstrates the vulnerability clearly, but the target URL, file names, and setup are hardcoded for a local lab environment.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.