Hard-coded HMAC key in Snowy allows unauthenticated file downloads
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.
Summary
Snowy version 3.6.5 from xiaonuobase contains a hard-coded HMAC key (CWE-321) used to sign file downloads. An unauthenticated remote attacker can forge signatures for the /dev/file/download endpoint using the published FILE_DOWNLOAD_SIGN_SECRET constant and download stored files such as avatars, editor images and attachments.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| xiaonuobase | Snowy | 3.6.5 – 3.6.5 | — | No fix listed | CNA |
- Snowy Vendorxiaonuobase Affected 3.6.5 – 3.6.5 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Snowy.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-13 Threatist record created from CVE-2026-110214
- 2026-10-13 Alias added: GHSA-jq4c-83mm-g2wr
References
Other 3
- https://github.com/xiaonuobase/Snowy/blob/v3.6.5/snowy-plugin/snowy-plugin-dev/src/main/java/vip/xiaonuo/dev/modular/file/service/impl/DevFileServiceImpl.java#L419-L445
- https://github.com/xiaonuobase/Snowy/blob/v3.6.5/snowy-plugin/snowy-plugin-dev/src/main/java/vip/xiaonuo/dev/modular/file/service/impl/DevFileServiceImpl.java#L78
- https://github.com/xiaonuobase/Snowy/blob/v3.6.5/snowy-web-app/src/main/java/vip/xiaonuo/core/config/GlobalConfigure.java#L174-L175
Sources
- CVE-2026-110214 · CVE Program
- CVE-2026-110214 · NVD
- FIRST EPSS
- GHSA-jq4c-83mm-g2wr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences