Is there a patch available for CVE-2026-35606?

Yes, a patch is available for CVE-2026-35606. Update the affected software to the latest version immediately.

Filebrowser CVE-2026-35606

Q: What is the CVSS score of CVE-2026-35606?

CVE-2026-35606 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19780 MEDIUM

Missing Authorization (CWE-862)

2026-04-07 GitHub_M

GHSA-67cg-cpj7-qgc9

Authentication Bypass Filebrowser

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 08, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 07, 2026 - 17:00 euvd

EUVD-2026-19780

Analysis Generated

Apr 07, 2026 - 17:00 vuln.today

CVE Published

Apr 07, 2026 - 16:29 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle) correctly verify this permission before serving content. A user with download: false can read any text file within their scope through two bypass paths. This vulnerability is fixed in 2.63.1.

AnalysisAI

File Browser versions prior to 2.63.1 allow authenticated users with download permission disabled to bypass access controls and read arbitrary text file content through the resourceGetHandler endpoint in http/resource.go, which fails to validate the Perm.Download permission flag unlike three other content-serving endpoints that correctly enforce this check. This authentication bypass affects any File Browser deployment where users are granted access but restricted from downloading files, and is fixed in version 2.63.1.

Technical ContextAI

File Browser is a web-based file management interface that implements role-based access controls through permission flags, including a Perm.Download flag intended to restrict file content delivery. The vulnerability exists in the resourceGetHandler function within http/resource.go, which directly serves text file content to authenticated users without verifying whether the Perm.Download permission has been granted. The inconsistency is noteworthy because three parallel endpoints (/api/raw, /api/preview, /api/subtitle) all correctly implement this permission check before serving content. The root cause is classified as CWE-862 (Missing Authorization), indicating a failure to enforce an access control decision at the point where file content is returned. The affected product is File Browser (CPE: cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*) in all versions before 2.63.1.

RemediationAI

Vendor-released patch: File Browser 2.63.1. Upgrade immediately to version 2.63.1 or later to apply the fix to http/resource.go that enforces Perm.Download permission validation in the resourceGetHandler endpoint, aligning it with the correctly-implemented /api/raw, /api/preview, and /api/subtitle endpoints. Verify the fix in your deployment by confirming that authenticated users with download: false can no longer retrieve file content through the affected endpoint. Details and patch availability are provided in the GitHub security advisory at https://github.com/filebrowser/filebrowser/security/advisories/GHSA-67cg-cpj7-qgc9. No workarounds are documented; upgrade is the recommended remediation path.