CVE-2026-123197: WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files
WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any deployment of WPPConnect Server through 2.10.76 that makes its /files static mount reachable to an attacker is exposed. The issue can disclose decrypted sticker media associated with any session.
What does an attacker need to exploit it?
No authentication, session token, user interaction, or prior access is required. An attacker can send GET requests for paths such as /files/file<timestamp>.webp and enumerate Unix timestamps to locate sticker files.
Are session token checks sufficient to prevent disclosure?
No. The vulnerable /files static mount bypasses the per-session token checks, allowing access to sticker media without a session token.
How can I determine whether this affects my server?
Check whether the server version is 2.10.76 or earlier and whether unauthenticated requests can reach the /files path. A successful unauthenticated request to a timestamp-derived file path returning sticker media indicates exposure.