PT-2026-22992 · Unknown · Filebrowser

Uug4Na · Published 2026-03-02 · Updated 2026-03-25 · CVE-2026-28492

Positive Technologies · (AI Summary)

CVSS v4.0

7.1

High

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.61.0

Description File Browser provides a file managing interface. A flaw exists where creating a public share link for a directory allows unauthorized access to sibling directories and their files. The withHashFile middleware in http/public.go incorrectly uses filepath.Dir(link.Path) to determine the filesystem root, resulting in access to the parent directory instead of the intended shared directory. This impacts the /api/public/share/{hash} (directory listing) and /api/public/dl/{hash}/path (file download) API endpoints. The vulnerable parameter is link.Path. This issue allows unauthenticated information disclosure, enabling anyone with a share link to browse and download files from directories outside the intended share.

Recommendations Update File Browser to version 2.61.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-28492

GHSA-MR74-928F-RW69

GO-2026-4585

Affected Products

Filebrowser

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28492.json · Exploit
• https://github.com/filebrowser/filebrowser/commit/31194fb57a5b92e7155219d7ec7273028fcb2e83 · Patch
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-mr74-928f-rw69 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28492 · Security Note
• https://osv.dev/vulnerability/GHSA-mr74-928f-rw69 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28492 · Vendor Advisory
• https://github.com/filebrowser/filebrowser/releases/tag/v2.61.0 · Note
• https://github.com/filebrowser/filebrowser · Note
• https://twitter.com/CVEnew/status/2030385204137726189 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029679361117306952 · Twitter Post
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post