PT-2026-24169 · Unknown · Filebrowser
Mdcoxe
·
Published
2026-03-09
·
Updated
2026-03-25
·
CVE-2026-30933
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
FileBrowser versions prior to 1.3.1-beta and 1.2.2-stable
Description
An incomplete remediation for a previous issue allows disclosure of tokenized download URLs via the
/public/api/share/info endpoint for password-protected shares. The issue arises because tokenized download URLs are written into the persistent share model and the public endpoint does not clear the DownloadURL before returning the share information. This allows an unauthenticated attacker to retrieve password-protected shared files without the password, resulting in authentication bypass and unauthorized file access. The vulnerable endpoint is /public/api/share/info, which returns share information including the DownloadURL. The DownloadURL parameter contains a token that grants access to the shared file. The vulnerable code is located in backend/http/share.go (specifically the convertToFrontendShareResponse function) and backend/share.go (specifically the shareInfoHandler method).Recommendations
Versions prior to 1.3.1-beta must be updated.
Versions prior to 1.2.2-stable must be updated.
Sanitize the
DownloadURL in public share info responses by setting commonShare.DownloadURL = "" before returning the JSON response in the shareInfoHandler method located in backend/share.go.Exploit
Fix
Information Disclosure
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Filebrowser