Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2026-30231
created 1 month, 1 week ago
Flare: Private File IDOR via raw/direct endpoints

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block unauthenticated users from accessing private files. Any authenticated, non‑owner user who knows the file URL can retrieve the content, which is inconsistent with stricter checks used by other endpoints. This issue has been patched in version 1.7.2.

Affected products

Flare
  • ==< 1.7.2

Matching in nixpkgs

pkgs.flare

Fantasy action RPG using the FLARE engine

  • nixos-unstable 1.14
    • nixpkgs-unstable 1.14
    • nixos-unstable-small 1.14
  • nixos-25.11 1.14
    • nixos-25.11-small 1.14
    • nixpkgs-25.11-darwin 1.14

pkgs.photoflare

Cross-platform image editor with a powerful features and a very friendly graphical user interface

pkgs.flare-floss

Automatically extract obfuscated strings from malware

pkgs.gotlsaflare

Update TLSA DANE records on cloudflare from x509 certificates

pkgs.cloudflare-dyndns

CloudFlare Dynamic DNS client

  • nixos-unstable 5.4
    • nixpkgs-unstable 5.4
    • nixos-unstable-small 5.4
  • nixos-25.11 5.4
    • nixos-25.11-small 5.4
    • nixpkgs-25.11-darwin 5.4

Package maintainers