PT-2026-49068 · Unknown · Filebrowser
CVSS v3.1
8.4
High
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
File Browser versions prior to 2.63.7
Description
An authenticated user can create a public share for an arbitrary path that does not yet exist. The system stores the share record without verifying the file's existence. Consequently, if a file is later created at that specific path, the previously established public share becomes active, exposing the new file to unauthorized access. This occurs because the share is linked to a path string rather than a specific object existing at the time of creation.
Technical details include:
- API Endpoints:
POST /api/share/<path>is used to create the share, andGET /api/public/dl/<hash>orGET /api/public/share/<hash>are used to access the file. - Vulnerable Function:
sharePostHandler()fails to perform an existence check before saving the share link.
Recommendations
Update File Browser to version 2.63.7.
Exploit
Fix
Exposure of Resource to Wrong Sphere
Incorrect Authorization
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Filebrowser