EUVD-2026-19780
GHSA-67cg-cpj7-qgc9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle) correctly verify this permission before serving content. A user with download: false can read any text file within their scope through two bypass paths. This vulnerability is fixed in 2.63.1.
AnalysisAI
File Browser versions prior to 2.63.1 allow authenticated users with download permission disabled to bypass access controls and read arbitrary text file content through the resourceGetHandler endpoint in http/resource.go, which fails to validate the Perm.Download permission flag unlike three other content-serving endpoints that correctly enforce this check. This authentication bypass affects any File Browser deployment where users are granted access but restricted from downloading files, and is fixed in version 2.63.1.
Technical ContextAI
File Browser is a web-based file management interface that implements role-based access controls through permission flags, including a Perm.Download flag intended to restrict file content delivery. The vulnerability exists in the resourceGetHandler function within http/resource.go, which directly serves text file content to authenticated users without verifying whether the Perm.Download permission has been granted. The inconsistency is noteworthy because three parallel endpoints (/api/raw, /api/preview, /api/subtitle) all correctly implement this permission check before serving content. The root cause is classified as CWE-862 (Missing Authorization), indicating a failure to enforce an access control decision at the point where file content is returned. The affected product is File Browser (CPE: cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*) in all versions before 2.63.1.
RemediationAI
Vendor-released patch: File Browser 2.63.1. Upgrade immediately to version 2.63.1 or later to apply the fix to http/resource.go that enforces Perm.Download permission validation in the resourceGetHandler endpoint, aligning it with the correctly-implemented /api/raw, /api/preview, and /api/subtitle endpoints. Verify the fix in your deployment by confirming that authenticated users with download: false can no longer retrieve file content through the affected endpoint. Details and patch availability are provided in the GitHub security advisory at https://github.com/filebrowser/filebrowser/security/advisories/GHSA-67cg-cpj7-qgc9. No workarounds are documented; upgrade is the recommended remediation path.
More in Filebrowser
View allUnauthorized file operations in File Browser before fix. PoC and patch available.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename,
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today