CVE-2026-62684

Name of the Vulnerable Software and Affected Versions filebrowser versions prior to v2.63.16

Description When creating a password-protected share or listing existing shares, the application includes the full bcrypt password hash and the secret token in the JSON response. This occurs because the Link storage struct is serialized directly using json.Marshal without field filtering. Any authenticated user can retrieve these secrets for their own shares, and an administrator using the GET /api/shares endpoint can obtain the password hash and bypass token for every user's shares. This exposure allows for offline cracking of share passwords and direct access to protected shares by using the bypass token.

Recommendations Update to a version where the password hash and token fields are excluded from JSON serialization. As a temporary mitigation, restrict administrative access to the GET /api/shares endpoint to minimize the risk of bulk secret exposure.