Which versions of Filebrowser are affected by CVE-2026-35604?

File Browser versions prior to 2.63.1 contain an authorization bypass that allows unauthenticated users to retain access to shared files even after administrators revoke sharing permissions, creating…. A patch is available.

How to fix or mitigate CVE-2026-35604?

Within 24 hours: Identify all File Browser instances in your environment and document current versions; disable or audit all active share links pending security review. Within 7 days: Upgrade all File Browser installations to version 2.63.1 or later and revoke/recreate all share links created under previous versions. Within 30 days: Implement access logging and monitoring for public share endpoints; conduct a data exposure assessment to identify any files that may have been accessed via revoked share links.

Filebrowser CVE-2026-35604

Q: What is the CVSS score of CVE-2026-35604?

CVE-2026-35604 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-19776 HIGH

Incorrect Authorization (CWE-863)

2026-04-07 GitHub_M

GHSA-v9w4-gm2x-6rvf

Authentication Bypass Filebrowser

8.2

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 18:37 vuln.today

cvss_changed

Patch released

Apr 08, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 07, 2026 - 17:00 euvd

EUVD-2026-19776

Analysis Generated

Apr 07, 2026 - 17:00 vuln.today

CVE Published

Apr 07, 2026 - 16:22 nvd

HIGH 8.2

DescriptionGitHub Advisory

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner's current permissions. This vulnerability is fixed in 2.63.1.

AnalysisAI

Authorization bypass in File Browser allows unauthenticated access to shared files after permissions revoked. When administrators revoke a user's Share and Download permissions in File Browser (versions prior to 2.63.1), previously created share links remain accessible to unauthenticated users due to missing permission re-validation in the public share handler. This CWE-863 authorization flaw enables persistent unauthorized data access with high confidentiality impact (CVSS 8.2), though no public exploit or active exploitation (not in CISA KEV) has been identified at time of analysis.

Technical ContextAI

File Browser is a web-based file management application (CPE: cpe:2.3:a:filebrowser:filebrowser) that provides administrative controls over user permissions including share creation and download capabilities. The vulnerability stems from CWE-863 (Incorrect Authorization), where the public share download handler fails to perform real-time permission validation against the share owner's current access rights. When processing requests to existing share links, the application does not query the user permission database to verify the share creator still possesses Share and Download privileges. This creates a time-of-check-time-of-use (TOCTOU) authorization gap where share links function as capability tokens that survive permission revocation. The CVSS 4.0 vector indicates network-accessible (AV:N), low attack complexity (AC:L), and no authentication required (PR:N), though attack requirements are present (AT:P) suggesting the attacker needs knowledge of existing share URLs.

RemediationAI

Upgrade File Browser to version 2.63.1 or later, which contains the authorization fix addressing improper permission validation in the public share handler. The vendor-released patch is available through the GitHub repository, with implementation details in pull request #5888 at https://github.com/filebrowser/filebrowser/pull/5888. After upgrading, administrators should audit existing share links, particularly those created by users whose Share and Download permissions have been revoked, as these links may have provided unauthorized access prior to remediation. Consider invalidating or regenerating share links for sensitive resources as a defense-in-depth measure. For organizations unable to immediately upgrade, temporary workarounds include disabling the public share feature entirely or implementing network-level access controls to restrict share link access to trusted IP ranges, though these are partial mitigations that do not fully address the authorization flaw. Consult the official GitHub security advisory GHSA-v9w4-gm2x-6rvf for additional vendor guidance.