Snowy 3.6.5 includes a hard‑coded HMAC key that is published in the source code as FILE_DOWNLOAD_SIGN_SECRET. An attacker who knows the constant can compute valid HMAC‑SHA256 signatures offline for any guessed file identifier and submit them to the /dev/file/download endpoint. Because the application trusts these signatures, the attacker can download private files such as avatars, editor images, and attachments, causing a confidentiality breach for users who have uploaded data to Snowy. The vulnerability allows this to happen without authentication, so any network user can exploit it, and the damage is limited to data exfiltration rather than code execution or denial of service. The CVSS score of 6.3 reflects this moderate but significant risk because it is uncontrolled and directly exposes sensitive data.

The affected product is Snowy from xiaonuobase, version 3.6.5. The flaw resides in the dev file service implementation and the global configuration which expose the hard‑coded secret. All installations of Snowy 3.6.5 that have not applied a newer release or patched the source code remain vulnerable.

The CVSS score of 6.3 indicates a medium severity vulnerability that provides remote attackers an unauthenticated data exfiltration path. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting no known active exploitation at this time. However, any external user who can guess or enumerate file IDs can forge signatures externally and download the associated files. The attack vector is remote network access, requiring no privileged credentials. The vulnerability is easy to exploit because the secret key is hard‑coded and publicly visible in the code base, and no additional conditions (e.g., elevated privileges or local access) are necessary.