EUVD-2026-19778
GHSA-5q48-q4fm-g3m6
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the Matches() function in rules/rules.go uses strings.HasPrefix() without a trailing directory separator when matching paths against access rules. A rule for /uploads also matches /uploads_backup/, granting or denying access to unintended directories. This vulnerability is fixed in 2.63.1.
AnalysisAI
File Browser versions prior to 2.63.1 contain a path traversal vulnerability in the Matches() function that fails to enforce directory boundaries when evaluating access control rules. An attacker can bypass intended access restrictions by exploiting the use of strings.HasPrefix() without trailing directory separators, allowing a rule intended to restrict access to /uploads to inadvertently grant or deny access to similarly-named directories such as /uploads_backup/. This affects all File Browser versions before 2.63.1 and requires network access but no authentication or user interaction; no public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
File Browser is a web-based file management application that implements access control through rule matching in the rules/rules.go module. The vulnerability stems from improper path canonicalization in the Matches() function, which uses Go's strings.HasPrefix() to validate whether a requested file path matches configured access control rules. Without requiring a trailing forward slash (/) in the prefix match, a rule designed to restrict access to /uploads/ will match any path beginning with /uploads, including unrelated directories like /uploads_backup/, /uploads_old/, or /uploads_test/. This is a classic path traversal class vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) where insufficient input validation allows access to paths outside the intended scope. The affected product is File Browser (CPE: cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*), which applies to all versions prior to 2.63.1.
RemediationAI
Upgrade File Browser to version 2.63.1 or later, which includes a corrected Matches() function that properly validates directory boundaries. The fix is documented in GitHub pull request #5889 (https://github.com/filebrowser/filebrowser/pull/5889) and is available in the official release. Organizations unable to upgrade immediately should review their access control rule configurations to identify and manually correct rules that may be overly permissive due to this bug (e.g., rules like /uploads should be explicitly scoped to /uploads/ with a trailing slash, though this is a workaround and not a substitute for patching). Users deploying File Browser via container images or package managers should pull the latest version once 2.63.1 is published to their distribution channels. The security advisory is available at https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5q48-q4fm-g3m6.
More in Filebrowser
View allUnauthorized file operations in File Browser before fix. PoC and patch available.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename,
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today