SB20260727348 - Multiple vulnerabilities in FileBrowser
Published: July 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper access control (CVE-ID: N/A)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to access protected routes and renew expired sessions.
The vulnerability exists due to improper access control in the shared authentication middleware when handling requests with an expired but validly signed JWT under proxy authentication with a non-default logout page. A remote user can present a previously valid signed token to access protected routes and renew expired sessions.
Administrative routes are affected when the token belongs to an administrator, and exploitation requires proxy authentication with a non-default auth.logoutPage configuration.
2) Improper Authorization (CVE-ID: N/A)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to access protected resources and administrative functionality with an expired token.
The vulnerability exists due to improper access control in the shared authentication middleware when processing requests under proxy authentication with a non-default logout page. A remote user can present an expired but validly signed token to access protected resources and administrative functionality with an expired token.
The issue occurs only when proxy authentication is enabled and auth.logoutPage is set to a non-default value. An expired token can also be exchanged for a fresh token at /api/renew.
3) Improper access control (CVE-ID: N/A)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to disclose sensitive information and modify or delete protected files.
The vulnerability exists due to improper access control in recursive copy, rename, and delete operations in http/resource.go when processing resource API requests on allowed parent paths with denied descendants. A remote user can copy, rename, or delete an allowed parent directory to disclose sensitive information and modify or delete protected files.
Exploitation requires a rule configuration that denies one or more descendant paths while leaving the parent path allowed, and the user must have the relevant file-operation permission on the parent directory.
Remediation
Install update from vendor's website.