CVE-2026-111674

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111674
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111674.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111674
Published
2026-10-16T17:39:34Z
Modified
2026-10-24T02:49:51Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Tbed through 20240319 Missing Authorization via setImgFileName Endpoint
Details

Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111674.json"
}
References

Affected packages

Git / github.com/hello-hao/tbed

Affected ranges

Type
GIT
Repo
https://github.com/hello-hao/tbed
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
113e69fff2f89666fc30021aa39c68c70c04f53a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "20240319"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "20240319"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

Other
20211101
20211129
20211229
20220127
20220216
20220221
20220328
20220407
20220421
20220506
20220712
20220901
20221027
20230101
20230320
20230519
20230622
20230918
20230925
20240102
20240111
20240124
20240130
20240319

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111674.json"