Is there a patch available for CVE-2026-35605?

Yes, a patch is available for CVE-2026-35605. Update the affected software to the latest version immediately.

Filebrowser CVE-2026-35605

Q: What is the CVSS score of CVE-2026-35605?

CVE-2026-35605 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-19778 MEDIUM

Path Traversal (CWE-22)

2026-04-07 GitHub_M

GHSA-5q48-q4fm-g3m6

Path Traversal Filebrowser

6.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 08, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 07, 2026 - 17:00 euvd

EUVD-2026-19778

Analysis Generated

Apr 07, 2026 - 17:00 vuln.today

CVE Published

Apr 07, 2026 - 16:24 nvd

MEDIUM 6.3

DescriptionGitHub Advisory

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the Matches() function in rules/rules.go uses strings.HasPrefix() without a trailing directory separator when matching paths against access rules. A rule for /uploads also matches /uploads_backup/, granting or denying access to unintended directories. This vulnerability is fixed in 2.63.1.

AnalysisAI

File Browser versions prior to 2.63.1 contain a path traversal vulnerability in the Matches() function that fails to enforce directory boundaries when evaluating access control rules. An attacker can bypass intended access restrictions by exploiting the use of strings.HasPrefix() without trailing directory separators, allowing a rule intended to restrict access to /uploads to inadvertently grant or deny access to similarly-named directories such as /uploads_backup/. This affects all File Browser versions before 2.63.1 and requires network access but no authentication or user interaction; no public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

File Browser is a web-based file management application that implements access control through rule matching in the rules/rules.go module. The vulnerability stems from improper path canonicalization in the Matches() function, which uses Go's strings.HasPrefix() to validate whether a requested file path matches configured access control rules. Without requiring a trailing forward slash (/) in the prefix match, a rule designed to restrict access to /uploads/ will match any path beginning with /uploads, including unrelated directories like /uploads_backup/, /uploads_old/, or /uploads_test/. This is a classic path traversal class vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) where insufficient input validation allows access to paths outside the intended scope. The affected product is File Browser (CPE: cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*), which applies to all versions prior to 2.63.1.

RemediationAI

Upgrade File Browser to version 2.63.1 or later, which includes a corrected Matches() function that properly validates directory boundaries. The fix is documented in GitHub pull request #5889 (https://github.com/filebrowser/filebrowser/pull/5889) and is available in the official release. Organizations unable to upgrade immediately should review their access control rule configurations to identify and manually correct rules that may be overly permissive due to this bug (e.g., rules like /uploads should be explicitly scoped to /uploads/ with a trailing slash, though this is a workaround and not a substitute for patching). Users deploying File Browser via container images or package managers should pull the latest version once 2.63.1 is published to their distribution channels. The security advisory is available at https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5q48-q4fm-g3m6.