Vulnerability Description
Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hyland | Alfresco Content Services | < 25.3 |
Related Weaknesses (CWE)
References
- https://connect.hyland.com/t5/alfresco-blog/cve-2026-26336-unauthenticated-arbitVendor Advisory
- https://www.hyland.com/en/solutions/products/alfresco-platformProduct
- https://www.vulncheck.com/advisories/hyland-alfresco-improper-authorization-arbiThird Party Advisory
FAQ
What is CVE-2026-26336?
CVE-2026-26336 is a vulnerability with a CVSS score of 7.5 (HIGH). Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive...
How severe is CVE-2026-26336?
CVE-2026-26336 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-26336?
Check the references section above for vendor advisories and patch information. Affected products include: Hyland Alfresco Content Services.