---
id: CVE-2026-71518
title: >-
  Typemill before 2.26.0 contains an authorization bypass vulnerability in the
  media file download route that allows unauthenticated attackers to access
  restricted files by submitting path-equivalent URL variants
summary: >-
  Typemill before 2.26.0 contains an authorization bypass vulnerability in the
  media file download route that allows unauthenticated attackers to access
  restricted files by submitting path-equivalent URL variants. Attackers can
  substitute …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-863
published: '2026-08-17'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T13:42:45.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71518'
references:
  - url: >-
      https://github.com/typemill/typemill/commit/8c621063b4697a94342cb0a4b3905adda60e3d25
    label: disclosure@vulncheck.com
  - url: 'https://github.com/typemill/typemill/releases/tag/v2.26.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/typemill-authorization-bypass-via-media-file-download-route
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
epss: 0.00511
epssPercentile: 0.41067
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/IlhomjonR/CVE-2026-71518'
  checkedAt: '2026-09-26T09:05:57.992Z'
exploitAvailable: true
ingestedAt: '2026-09-16T13:56:12.590Z'
---

## Overview

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves the request to the protected file, enabling unauthorized file download without credentials.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.