CVE-2026-30578: Leefish File Thingie

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

File Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "dir" parameter of the GET request to invoke arbitrary javascript code.

Affected products

• Leefish File Thingie: version 2.5.7 only

Published 2026-03-20. Last modified 2026-06-17.