Filebrowser EUVD-2026-19780

This vulnerability presents moderate real-world risk despite its low CVSS score of 5.3. The CVSS vector indicates network-accessible attack surface (AV:N), low attack complexity (AC:L), and low confidentiality impact (VC:L), requiring low privileges (PR:L), meaning an authenticated user with explicit download restrictions can exploit it. The SSVC decision framework signals this is an authorization bypass rather than a high-impact compromise: the technical impact is limited to confidentiality of text files within the user's authorized scope, not system compromise or lateral movement. However, the practical risk depends on deployment context-in scenarios where File Browser manages sensitive documents and administrators intentionally restrict downloads to enforce audit trails or DLP policies, this bypass directly undermines those controls. The discrepancy between the correctly-implemented /api/raw, /api/preview, and /api/subtitle endpoints and the broken resourceGetHandler suggests this was a code review gap rather than an architectural flaw, making it a legitimate authorization enforcement defect. Prioritization should consider whether your deployment relies on download restrictions for compliance or data protection, rather than treating this as a generic low-CVSS issue.

An authenticated user with legitimate access to File Browser but with their download permission flag explicitly disabled by an administrator (download: false) can craft requests to the resourceGetHandler endpoint to retrieve and read the full text content of files within their authorized directory scope. For example, a contractor granted read-only access to a project directory for reference purposes, but restricted from downloading files to maintain compliance logging, could bypass this restriction by directly requesting file content through the vulnerable endpoint. No public exploit code has been identified at time of analysis, but the simplicity of the bypass-sending a request to a standard HTTP endpoint without additional exploitation technique-makes this trivial to execute once the vulnerability is known.