Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2026-30230
created 1 month, 1 week ago
Flare: Password‑Protected Thumbnail Bypass

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail endpoint does not validate the password for password‑protected files. It checks ownership/admin for private files but skips password verification, allowing thumbnail access without the password. This issue has been patched in version 1.7.2.

Affected products

Flare
  • ==< 1.7.2

Matching in nixpkgs

pkgs.flare

Fantasy action RPG using the FLARE engine

  • nixos-unstable 1.14
    • nixpkgs-unstable 1.14
    • nixos-unstable-small 1.14
  • nixos-25.11 1.14
    • nixos-25.11-small 1.14
    • nixpkgs-25.11-darwin 1.14

pkgs.photoflare

Cross-platform image editor with a powerful features and a very friendly graphical user interface

pkgs.flare-floss

Automatically extract obfuscated strings from malware

pkgs.gotlsaflare

Update TLSA DANE records on cloudflare from x509 certificates

pkgs.cloudflare-dyndns

CloudFlare Dynamic DNS client

  • nixos-unstable 5.4
    • nixpkgs-unstable 5.4
    • nixos-unstable-small 5.4
  • nixos-25.11 5.4
    • nixos-25.11-small 5.4
    • nixpkgs-25.11-darwin 5.4

Package maintainers