high7.5
CVE-2026-26336
Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, th…
Impact
Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hyland | Alfresco Content Services | before 25.3 from 7.4.0 through 7.4.2.5 from 23.1 through 23.6.0 from 25.1 through 25.2 |