EUVD-2026-19776
GHSA-v9w4-gm2x-6rvf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner's current permissions. This vulnerability is fixed in 2.63.1.
AnalysisAI
Authorization bypass in File Browser allows unauthenticated access to shared files after permissions revoked. When administrators revoke a user's Share and Download permissions in File Browser (versions prior to 2.63.1), previously created share links remain accessible to unauthenticated users due to missing permission re-validation in the public share handler. This CWE-863 authorization flaw enables persistent unauthorized data access with high confidentiality impact (CVSS 8.2), though no public exploit or active exploitation (not in CISA KEV) has been identified at time of analysis.
Technical ContextAI
File Browser is a web-based file management application (CPE: cpe:2.3:a:filebrowser:filebrowser) that provides administrative controls over user permissions including share creation and download capabilities. The vulnerability stems from CWE-863 (Incorrect Authorization), where the public share download handler fails to perform real-time permission validation against the share owner's current access rights. When processing requests to existing share links, the application does not query the user permission database to verify the share creator still possesses Share and Download privileges. This creates a time-of-check-time-of-use (TOCTOU) authorization gap where share links function as capability tokens that survive permission revocation. The CVSS 4.0 vector indicates network-accessible (AV:N), low attack complexity (AC:L), and no authentication required (PR:N), though attack requirements are present (AT:P) suggesting the attacker needs knowledge of existing share URLs.
RemediationAI
Upgrade File Browser to version 2.63.1 or later, which contains the authorization fix addressing improper permission validation in the public share handler. The vendor-released patch is available through the GitHub repository, with implementation details in pull request #5888 at https://github.com/filebrowser/filebrowser/pull/5888. After upgrading, administrators should audit existing share links, particularly those created by users whose Share and Download permissions have been revoked, as these links may have provided unauthorized access prior to remediation. Consider invalidating or regenerating share links for sensitive resources as a defense-in-depth measure. For organizations unable to immediately upgrade, temporary workarounds include disabling the public share feature entirely or implementing network-level access controls to restrict share link access to trusted IP ranges, though these are partial mitigations that do not fully address the authorization flaw. Consult the official GitHub security advisory GHSA-v9w4-gm2x-6rvf for additional vendor guidance.
More in Filebrowser
View allUnauthorized file operations in File Browser before fix. PoC and patch available.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename,
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today