Filebrowser CVE-2026-35604

File Browser versions prior to 2.63.1. Attacker needs a share link created by a user whose Share and Download permissions were subsequently revoked by an admin. Unauthenticated remote access to the public share download handler allows file access without re-authentication.

Real-world risk is moderate despite the 8.2 CVSS score. The high confidentiality impact (VC:H) reflects potential data exposure, but practical exploitation requires attackers to possess or discover valid share URLs created before permission revocation (AT:P in CVSS vector). No EPSS score is available for this recent CVE, and it does not appear in CISA KEV, indicating no confirmed active exploitation. A publicly available fix exists via GitHub PR #5888, suggesting the technical details are known to security researchers, though no weaponized exploit code is publicly identified at time of analysis. The SSVC decision framework would classify this as having controlled diffusion (exploitation not active), though the technical impact is high for confidentiality. Primary risk scenarios involve environments where administrators frequently rotate user permissions or revoke access for departing employees, expecting immediate enforcement. Organizations with long-lived share links and high-sensitivity file repositories face elevated exposure. The authentication bypass tag confirms this bypasses intended access controls, making it a priority for environments handling sensitive data, but lower urgency than actively exploited vulnerabilities.

An administrator revokes Share and Download permissions for a departing contractor who previously created public share links to sensitive project documentation stored in File Browser. Despite the permission revocation appearing successful in the admin interface, the contractor retains the share URLs in their browser history or documentation. Days later, the contractor accesses these URLs without authentication and successfully downloads confidential files, as the public share handler never re-validates that their account still possesses sharing privileges. The attack requires only network access and knowledge of previously created share URLs (low complexity, no authentication required per CVSS vector), making it feasible for former employees or anyone who obtained share links during their validity period. No publicly available exploit code exists, but the vulnerability mechanism is straightforward enough for manual exploitation once share URLs are known.