https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-30942.htmlhttps://patchthecve.com/cve/CVE-2026-30942.htmlWed, 17 Jun 2026 10:33:11 +0000MEDIUM 6.5: Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to 1.7.3, an authenticated path traversal vulnerability in /api/avatars/[filename] allows any logged-in user to read arbitrary files from within the application container. The filename URL parahttps://patchthecve.com/cve/CVE-2026-30231.htmlhttps://patchthecve.com/cve/CVE-2026-30231.htmlWed, 17 Jun 2026 10:32:31 +0000MEDIUM 5.3: Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block unauthenticated users from accessing private files. Any authenticated, non‑owner user who knows the file URL can retrieve the contenthttps://patchthecve.com/cve/CVE-2026-30230.htmlhttps://patchthecve.com/cve/CVE-2026-30230.htmlWed, 17 Jun 2026 10:32:31 +0000HIGH 7.5: Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail endpoint does not validate the password for password‑protected files. It checks ownership/admin for private files but skips password verification, allowing thumbhttps://patchthecve.com/cve/CVE-2026-26993.htmlhttps://patchthecve.com/cve/CVE-2026-26993.htmlWed, 17 Jun 2026 10:26:30 +0000MEDIUM 4.6: Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Versions 1.7.0 and below allow users to upload files without proper content validation or sanitization. By embedding malicious JavaScript within an SVG (or other active content formats such as HTML o