CVE-2026-110214

38th percentile - higher than 38% of all known CVEs

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments.

The risk includes unauthorized access to stored files, potentially leading to exposure of user data or sensitive information.

Replace the HMAC key with a random, undisclosed key, update Snowy to a patched version, and consider adding authentication mechanisms for file downloads.