FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory

Summary

When a user creates a public share link for a directory, the withHashFile middleware in http/public.go (line 59) uses filepath.Dir(link.Path) to compute the BasePathFs root. This sets the filesystem root to the parent directory instead of the shared directory itself, allowing anyone with the share link to browse and download files from all sibling directories.

Details

In http/public.go lines 52-64, the withHashFile function handles public share link requests:

basePath := link.Path    // e.g. "/documents/shared"
filePath := ""

if file.IsDir {
    basePath = filepath.Dir(basePath)  // BUG: becomes "/documents" (parent!)
    filePath = ifPath
}

d.user.Fs = afero.NewBasePathFs(d.user.Fs, basePath)

When a directory at /documents/shared is shared, filepath.Dir("/documents/shared") evaluates to "/documents". The BasePathFs is then rooted at the parent directory /documents/, giving the share link access to everything under /documents/ - not just the intended /documents/shared/.

This affects both publicShareHandler (directory listing via /api/public/share/{hash}) and publicDlHandler (file download via /api/public/dl/{hash}/path).

PoC

1. Set up filebrowser with a user whose scope contains:
2. • /documents/shared/public-file.txt (intended to be shared)
3. • /documents/secrets/passwords.txt (NOT intended to be shared)
4. • /documents/private/financial.csv (NOT intended to be shared)
5. Create a public share link for the directory /documents/shared (via POST /api/share/documents/shared)
6. Access the share link: GET /api/public/share/{hash}
7. • Expected: Lists only contents of /documents/shared/
8. • Actual: Lists contents of /documents/ (parent), revealing secrets/, private/, and directories