En resumen
- CVE-2026-32761 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2, https://github.com/filebrowser/filebrowser.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.43%, mayor que el 37.4% de las vulnerabilidades.
- Solución: actualizar a 2.62.0 o posterior.
Description
Summary
A permission enforcement flaw allows users without download privileges (download=false) to still expose and retrieve file content via public share links when they retain share privileges (share=true). This bypasses intended access control policy and enables unauthorized data exfiltration to unauthenticated users. Where download restrictions are used for data-loss prevention or role separation.
Details
The backend applies inconsistent authorization checks across download paths:
- Direct raw download correctly enforces
Perm.Download:
- [raw.go](filebrowser/http/raw.go:82)
- Share creation only enforces
Perm.Share:
- [share.go](filebrowser/http/share.go:21)
- Public share/download handlers serve shared content without verifying owner
Perm.Download:
As a result, a user who is blocked from direct downloads can create a share and obtain the same file via /api/public/dl/<hash>.
PoC
- Create a non-admin user with:
perm.share = trueperm.download = false
- Login as that user and upload a PDF file:
POST /api/resources/nodl_secret_<rand>.pdf with Content-Type: application/pdf
- Verify direct raw download is denied:
GET /api/raw/nodl_secret_<rand>.pdf- Expected and observed:
202 Accepted (blocked)
- Create share for same file:
POST /api/share/nodl_secret_<rand>.pdf- Observed:
200, response includes hash (example: qxfK3JMG)
- Download publicly without authentication:
GET /api/public/dl/<hash>- Observed (vulnerable):
200, Content-Type: application/pdf, and PDF bytes are returned
Live evidence captured (March 1, 2026):
create user: 201create file: 200direct /api/raw: 202 Acceptedcreate share: 200public download /api/public/dl/mxK-ppZb: 200public download content-type: application/pdfpublic download body length: 327 bytes
Impact
This is an access control / authorization policy bypass vulnerability.
- Who can exploit: Any authenticated user granted
share=true but denied download.
- Who is impacted: Operators and organizations relying on download restrictions to prevent data export.
- What can happen: Restricted users can still distribute and retrieve files publicly, including unauthenticated access through share URLs.
NVD description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and below contain a permission enforcement bypass which allows users who are denied download privileges (perm.download = false) but granted share privileges (perm.share = true) to exfiltrate file content by creating public share links. While the direct raw download endpoint (/api/raw/) correctly enforces the download permission, the share creation endpoint only checks Perm.Share, and the public download handler (/api/public/dl/<hash>) serves file content without verifying that the original file owner has download permission. This means any authenticated user with share access can circumvent download restrictions by sharing a file and then retrieving it via the unauthenticated public download URL. The vulnerability undermines data-loss prevention and role-separation policies, as restricted users can publicly distribute files they are explicitly blocked from downloading directly. This issue has been fixed in version 2.62.0.
Más vulnerabilidades de github.com/filebrowser/filebrowser
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free