File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

Summary

This is similar vulnrability of CVE-2026-0035, which was fixed in Android MediaProvider with high severity. In the original Java issue, MediaStore.createWriteRequest() accepted attacker-controlled URIs and created a future grant even when the referenced media item did not exist yet. The Android fix added an existence check before creating the request.

filebrowser/filebrowser has the analogous issue in Go. POST /api/share/<path> accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created public share immediately becomes valid and exposes the new file through GET /api/public/dl/<hash>.

Details

The vulnerable create path is:

• http/share.go
• sharePostHandler()
• route: POST /api/share/<path>

sharePostHandler() only checks that the caller is authenticated and has share/download permissions. It then builds a share.Link directly from r.URL.Path and saves it:

s = &share.Link{
    Path:         r.URL.Path,
    Hash:         str,
    Expire:       expire,
    UserID:       d.user.ID,
    PasswordHash: string(hash),
    Token:        token,
}

if err := d.store.Share.Save(s); err != nil {
    return http.StatusInternalServerError, err
}

There is no Stat, Exists, or equivalent check before the public share record is committed.

The vulnerable consume path is:

• http/public.go
• withHashFile()
• routes: GET /api/public/share/<hash>, GET /api/public/dl/<hash>

Each public request loads the saved share by hash and then resolves link.Path against the owner's current filesystem state:

file, err := files.NewFileInfo(&files.FileOptions{
    Fs:   d.user.Fs,
    Path: link.Path,
    ...
})

This means the share is not bound to an object that existed at creation time. It is bound only to a path string, so a share created for a nonexistent path becomes valid later as soon as that path is populated.

PoC

The PoC below starts from external HTTP input only.