CVE-2026-25154

LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without needing an internet connection. In versions up to and including 1.17.0, when a user initiates a "Share via Link" session, the LocalSend application starts a local HTTP server to host the selected files. The client-side logic for this web interface is contained in `app/assets/web/main.js`. Note that at [0], the `handleFilesDisplay` function constructs the HTML for the file list by iterating over the files received from the server. Commit 8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c contains a patch.

• CWE-79

• https://github.com/localsend/localsend/commit/8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504cPatch
• https://github.com/localsend/localsend/security/advisories/GHSA-34v6-52hh-x4r4Exploit, Vendor Advisory

Published

Jan 30, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25149Qwik is a performance focused javascript framework. Prior to…6.1
• CVE-2026-2515The Hostinger Reach – AI-Powered Email Marketing for WordPre…5.3
• CVE-2026-25150Qwik is a performance focused javascript framework. Prior to…10
• CVE-2026-25151Qwik is a performance focused javascript framework. Prior to…5.9
• CVE-2026-25152Backstage is an open framework for building developer portal…6.5
• CVE-2026-25153Backstage is an open framework for building developer portal…8.8
• CVE-2026-25155Qwik is a performance focused javascript framework. Prior to…7.1
• CVE-2026-25156HotCRP is conference review software. HotCRP versions from O…6.3
• CVE-2026-25157OpenClaw is a personal AI assistant. Prior to version 2026.1…7.5
• CVE-2026-2516A vulnerability was identified in Unidocs ezPDF DRM Reader a…7
• CVE-2026-25160Alist is a file list program that supports multiple storages…7.4
• CVE-2026-25161Alist is a file list program that supports multiple storages…8.8