CVE-2026-35606

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.1

Description File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. The resourceGetHandler function in http/resource.go returns the full content of text files without verifying the Perm.Download permission flag. While other content-serving endpoints such as /api/raw, /api/preview, and /api/subtitle correctly enforce this permission, a user with download: false can bypass this restriction to read any text file within their authorized scope. This occurs through two paths: the /api/resources endpoint returning a JSON content field and the use of the X-Encoding: true header to return raw bytes. This issue allows unauthorized access to sensitive information such as source code, configuration files, credentials, and API tokens stored as text.

Recommendations Update File Browser to version 2.63.1.