File Browser has an Authorization Policy Bypass in its Public Share Download Flow

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and below contain a permission enforcement bypass which allows users who are denied download privileges (perm.download = false) but granted share privileges (perm.share = true) to exfiltrate file content by creating public share links. While the direct raw download endpoint (/api/raw/) correctly enforces the download permission, the share creation endpoint only checks Perm.Share, and the public download handler (/api/public/dl/<hash>) serves file content without verifying that the original file owner has download permission. This means any authenticated user with share access can circumvent download restrictions by sharing a file and then retrieving it via the unauthenticated public download URL. The vulnerability undermines data-loss prevention and role-separation policies, as restricted users can publicly distribute files they are explicitly blocked from downloading directly. This issue has been fixed in version 2.62.0.

Source published

19 Mar 2026 23:45:33 UTC

Source modified

21 Mar 2026 03:04:15 UTC

Saved here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and below contain a permission enforcement bypass which allows users who are denied download privileges (perm.download = false) but granted share privileges (perm.share = true) to exfiltrate file content by creating public share links. While the direct raw download endpoint (/api/raw/) correctly enforces the download permission, the share creation endpoint only checks Perm.Share, and the public download handler (/api/public/dl/<hash>) serves file content without verifying that the original file owner has download permission. This means any authenticated user with share access can circumvent download restrictions by sharing a file and then retrieving it via the unauthenticated public download URL. The vulnerability undermines data-loss prevention and role-separation policies, as restricted users can publicly distribute files they are explicitly blocked from downloading directly. This issue has been fixed in version 2.62.0.

Source published

Mar 19, 2026, 11:45:33 PM (timezone not stated)

Source modified

Mar 21, 2026, 3:04:15 AM (timezone not stated)

Saved here

15 Nov 2026 09:36:30 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and below contain a permission enforcement bypass which allows users who are denied download privileges (perm.download = false) but granted share privileges (perm.share = true) to exfiltrate file content by creating public share links. While the direct raw download endpoint (/api/raw/) correctly enforces the download permission, the share creation endpoint only checks Perm.Share, and the public download handler (/api/public/dl/<hash>) serves file content without verifying that the original file owner has download permission. This means any authenticated user with share access can circumvent download restrictions by sharing a file and then retrieving it via the unauthenticated public download URL. The vulnerability undermines data-loss prevention and role-separation policies, as restricted users can publicly distribute files they are explicitly blocked from downloading directly. This issue has been fixed in version 2.62.0.

Source published

20 Mar 2026 00:16:17 UTC

Source modified

17 Jun 2026 10:36:20 UTC

Saved here

25 Oct 2026 07:19:26 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · [email protected] · Secondary · 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

### Summary A permission enforcement flaw allows users without download privileges (`download=false`) to still expose and retrieve file content via public share links when they retain share privileges (`share=true`). This bypasses intended access control policy and enables unauthorized data exfiltration to unauthenticated users. Where download restrictions are used for data-loss prevention or role separation. ### Details The backend applies inconsistent authorization checks across download paths: - Direct raw download correctly enforces `Perm.Download`: - [[raw.go](https://github.com/filebrowser/filebrowser/blob/master/http/raw.go#82)](filebrowser/http/raw.go:82) - Share creation only enforces `Perm.Share`: - [[share.go](https://github.com/filebrowser/filebrowser/blob/master/http/share.go#21)](filebrowser/http/share.go:21) - Public share/download handlers serve shared content without verifying owner `Perm.Download`: - [public.go](https://github.com/filebrowser/filebrowser/blob/master/http/public.go#18)(filebrowser/http/public.go:18) - [public.go](https://github.com/filebrowser/filebrowser/blob/master/http/public.go#116)(filebrowser/http/public.go:116) As a result, a user who is blocked from direct downloads can create a share and obtain the same file via `/api/public/dl/<hash>`. ### PoC 1. Create a non-admin user with: - `perm.share = true` - `perm.download = false` 2. Login as that user and upload a **PDF** file: - `POST /api/resources/nodl_secret_<rand>.pdf` with `Content-Type: application/pdf` 3. Verify direct raw download is denied: - `GET /api/raw/nodl_secret_<rand>.pdf` - Expected and observed: `202 Accepted` (blocked) 4. Create share for same file: - `POST /api/share/nodl_secret_<rand>.pdf` - Observed: `200`, response includes `hash` (example: `qxfK3JMG`) 5. Download publicly without authentication: - `GET /api/public/dl/<hash>` - Observed (vulnerable): `200`, `Content-Type: application/pdf`, and PDF bytes are returned Live evidence captured (March 1, 2026): - `create user`: `201` - `create file`: `200` - `direct /api/raw`: `202 Accepted` - `create share`: `200` - `public download /api/public/dl/mxK-ppZb`: `200` - `public download content-type`: `application/pdf` - `public download body length`: `327` bytes ### Impact This is an **access control / authorization policy bypass** vulnerability. - **Who can exploit:** Any authenticated user granted `share=true` but denied `download`. - **Who is impacted:** Operators and organizations relying on download restrictions to prevent data export. - **What can happen:** Restricted users can still distribute and retrieve files publicly, including unauthenticated access through share URLs.

Source published

18 Mar 2026 12:59:12 UTC

Source modified

10 Sep 2026 03:50:59 UTC

Saved here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Publisher rating · MODERATE

File Browser has an Authorization Policy Bypass in Public Share Download Flow in github.com/filebrowser/filebrowser

Source published

7 Apr 2026 14:58:41 UTC

Source modified

7 Apr 2026 15:15:14 UTC

Saved here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.