SB2026062988 - Multiple vulnerabilities in FileBrowser

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026062988

SB2026062988 - Multiple vulnerabilities in FileBrowser

Published: June 29, 2026 Updated: September 14, 2026

Security Bulletin ID SB2026062988
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 40% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Incorrect authorization (CVE-ID: CVE-2026-62683)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in the public share cleanup logic in storage/bolt/share.go when deleting a shared directory through a trailing-slash path. A remote user can create a public share and send an authenticated delete request for the shared directory path with a trailing slash to disclose sensitive information.

The stale public share remains dormant until a directory at the same path is recreated, after which the old public URL exposes the new directory contents without authentication.


2) Insufficiently protected credentials (CVE-ID: CVE-2026-62684)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and bypass password protection for shared resources.

The vulnerability exists due to insufficiently protected credentials in the share API when handling share creation and listing requests. A remote privileged user can retrieve the exposed password hash and bypass token from JSON responses to disclose sensitive information and bypass password protection for shared resources.

An administrator listing shares through GET /api/shares receives these secrets for every user's password-protected shares, and exposed bcrypt hashes may be subjected to offline cracking.


3) Path traversal (CVE-ID: CVE-2026-62843)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to overwrite files outside the intended extraction directory.

The vulnerability exists due to path traversal in the archive builder when generating archive entry names from uploaded filenames containing backslashes. A remote user can upload a file with a crafted backslash-containing name and have it emitted into a downloaded archive as a traversal path to overwrite files outside the intended extraction directory.

User interaction is required to extract a downloaded archive, and the issue affects generated zip, tar, and related archive formats that use the shared archive entry name field.


4) Use of Incorrectly-Resolved Name or Reference (CVE-ID: CVE-2026-62685)

CWE-ID: CWE-706 - Use of Incorrectly-Resolved Name or Reference

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read and modify another user's files.

The vulnerability exists due to use of incorrectly-resolved name or reference in home directory scope generation when registering a username that normalizes to an existing user's scope. A remote attacker can register a specially crafted username to read and modify another user's files.

Exploitation requires both self-registration and automatic home-directory creation to be enabled.


5) Incorrect Privilege Assignment (CVE-ID: CVE-2026-72839)

CWE-ID: CWE-266 - Incorrect Privilege Assignment

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read, modify, and delete arbitrary files managed by the application.

The vulnerability exists due to incorrect privilege assignment in the signupHandler endpoint when creating accounts through self-registration. A remote attacker can register a new account and inherit the server root scope with create, modify, delete, rename, share, and download permissions to read, modify, and delete arbitrary files managed by the application.

Exploitation requires self-registration to be enabled while the default CreateUserDir setting remains unchanged.


Remediation

Install update from vendor's website.

References