SB20260727344 - Multiple vulnerabilities in FileBrowser

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260727344

SB20260727344 - Multiple vulnerabilities in FileBrowser

Published: July 27, 2026

Security Bulletin ID SB20260727344
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Medium 25% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the /api/resources endpoint checksum branch when handling checksum requests for readable files. A remote user can send a specially crafted GET request with the checksum parameter to disclose sensitive information.

The issue bypasses only the Download permission check and returns a file digest rather than plaintext content. It does not bypass scope or path authorization.


2) Improper Handling of Case Sensitivity (CVE-ID: N/A)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read, overwrite, and delete another user's files.

The vulnerability exists due to improper handling of case sensitivity in the signup username and home directory scope ownership check when creating self-registered accounts on a case-insensitive filesystem. A remote attacker can register a second account whose username differs only by letter case to read, overwrite, and delete another user's files.

Exploitation requires signup and automatic user directory creation to be enabled, with the application root located on a case-insensitive Windows filesystem.


3) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the TUS resumable-upload endpoint and tusPatchHandler when handling PATCH requests for uploads. A remote user can send an oversized PATCH request body that exceeds the declared upload length to cause a denial of service.

The issue affects uploads where the server writes request data before enforcing the remaining expected length for the upload.


4) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete arbitrary files outside the intended scope and cause a denial of service.

The vulnerability exists due to improper link resolution before file access in the TUS upload-cache eviction logic when expiring in-progress uploads from the default in-memory cache. A remote user can start a TUS upload and swap an ancestor directory for a symlink before cache expiry to delete arbitrary files outside the intended scope and cause a denial of service.

The issue affects only the default in-memory upload cache and requires an out-of-band symlink swap during the cache TTL window.


Remediation

Install update from vendor's website.

References