PT-2026-22992 · Unknown · Filebrowser

Uug4Na · Published 2026-03-02 · Updated 2026-05-07 · CVE-2026-28492

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.61.0

Description File Browser provides a file managing interface. A directory traversal issue exists in public share links prior to version 2.61.0. The withHashFile middleware in http/public.go incorrectly uses filepath.Dir(link.Path) to determine the filesystem root for shared directories. This allows anyone with a share link to access files in sibling directories, leading to unauthenticated information disclosure. The issue affects both directory listing via /api/public/share/{hash} and file download via /api/public/dl/{hash}/path. The root cause is that the filesystem root is set to the parent directory instead of the shared directory itself. This allows access to files outside the intended shared directory.

Recommendations Update File Browser to version 2.61.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-28492

GHSA-MR74-928F-RW69

GO-2026-4585

SUSE-SU-2026:1042-1

Affected Products

Filebrowser

References · 139

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28492.json · Exploit
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-mr74-928f-rw69 · Vendor Advisory
• https://github.com/filebrowser/filebrowser/commit/31194fb57a5b92e7155219d7ec7273028fcb2e83 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4585 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28492 · Security Note
• https://osv.dev/vulnerability/GHSA-mr74-928f-rw69 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/releases/tag/v2.61.0 · Note
• https://suse.com/security/cve/CVE-2026-30933 · Note
• https://suse.com/security/cve/CVE-2026-28790 · Note
• https://suse.com/security/cve/CVE-2026-28268 · Note
• https://suse.com/security/cve/CVE-2026-27944 · Note
• https://suse.com/security/cve/CVE-2026-28683 · Note