ZFile before version 5.0.5 does not validate requested file paths against the set of allowed entries for a share link. An attacker who can obtain a share link can supply any file path as a query parameter on the download endpoint, causing the server to return that file if it resides under the shared base directory. This permits disclosure of arbitrary files, potentially including sensitive configuration or user data, without needing additional credentials or exploiting other system weaknesses. The flaw is an example of an authorization bypass via a user‑controlled path.

The vulnerability affects the ZFile file‑sharing application produced by zfile‑dev. All releases up to and including version 5.0.5 are impacted. Exact versions above 5.0.5 are not affected.

The CVSS score of 8.7 indicates a high severity flaw. Because the exploit requires only the possession of a share link and can be performed over the public download endpoint, it is realistic for attackers to abuse this without further access. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based HTTP(S) request to the download API, supplied with a malicious file‑path query. The high CVSS coupled with the ease of triggering the download endpoint leads to a substantial risk for exposed internal data.