CVE-2026-30579: Leefish File Thingie

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

File Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "upload file" functionality to upload a file with a crafted file name used to trigger a Javascript payload.

Affected products

• Leefish File Thingie: version 2.5.7 only

Published 2026-03-20. Last modified 2026-06-17.