Authorization bypass through user-controlled key in FileBrowser - #VU133480

Detailed vulnerability description

The vulnerability allows a remote user to delete share-link records belonging to other users.

The vulnerability exists due to authorization bypass through user-controlled key in DeleteWithPathPrefix share cleanup logic when processing a legitimate file deletion request using a logical path that is a byte-prefix of another user's stored share path. A remote user can delete a file in their own directory with a crafted path prefix to delete share-link records belonging to other users.

The issue affects share-link metadata only; file contents are not exposed. The vulnerable behavior occurs in the file-deletion cleanup path, which does not enforce the per-user ownership check applied by direct share deletion.

Remediation

Sources

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5ww9-jg6q-38r7