High severity7.5NVD Advisory· Published Feb 19, 2026· Updated Jun 17, 2026
CVE-2026-26336
CVE-2026-26336
Description
Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:hyland:alfresco_content_services:*:*:*:*:community:*:*:*+ 1 more
- cpe:2.3:a:hyland:alfresco_content_services:*:*:*:*:community:*:*:*range: <25.3
- cpe:2.3:a:hyland:alfresco_content_services:*:*:*:*:enterprise:*:*:*range: >=7.4.0,<=7.4.2.5
- Range: 0
Patches
Vulnerability mechanics
References
3- connect.hyland.com/t5/alfresco-blog/cve-2026-26336-unauthenticated-arbitrary-file-read-in-alfresco/ba-p/496550nvdVendor Advisory
- www.vulncheck.com/advisories/hyland-alfresco-improper-authorization-arbitrary-file-readnvdThird Party Advisory
- www.hyland.com/en/solutions/products/alfresco-platformnvdProduct
News mentions
0No linked articles in our index yet.