CVE-2026-110214: Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download
Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Snowy 3.6.5 deployments with the /dev/file/download endpoint reachable by an attacker are exposed. The affected files may include avatars, editor images, and attachments stored by the application.
What does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker needs to guess file IDs and can generate valid HMAC-SHA256 download signatures offline using the published FILE_DOWNLOAD_SIGN_SECRET constant.
Is immediate patching the only mitigation?
The provided information does not identify a fixed version or alternative configuration. Until a fix is available, restricting untrusted network access to the affected download endpoint can reduce exposure.
How can defenders assess whether files may have been accessed?
Review access logs for requests to /dev/file/download, especially requests from unauthenticated sources and unusual patterns of file-ID enumeration. The available information does not specify a distinctive signature format or log indicator beyond use of that endpoint.