PT-2026-25856 · Unknown · Filebrowser

Iconnnjka · Published 2026-03-16 · Updated 2026-03-27 · CVE-2026-32758

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions File Browser versions 2.61.2 and below

Description File Browser, a file managing interface, has an issue where an authenticated user with Create or Rename permissions can bypass administrator-configured deny rules. This is due to the order in which path validation and cleaning occur. The destination path is validated against access rules before being cleaned, and the actual file operation cleans the path afterward, resolving '..' sequences into a different effective path. This allows users to inject '..' sequences in the destination parameter of a PATCH request to write or move files to protected paths within their scope. The issue resides in the resourcePatchHandler within http/resource.go. The rules engine uses literal string prefix matching or regex matching against the raw path, while the file operation calls path.Clean() which resolves '..' sequences. This does not allow escaping the user's BasePathFs scope or reading from restricted paths.

Recommendations Versions prior to 2.62.0 are affected. Update to version 2.62.0 or later to resolve this issue.

Exploit

Fix

Path traversal

Incorrect Authorization

Weakness Enumeration

CWE-22

CWE-863

Related Identifiers

CVE-2026-32758

GHSA-9F3R-2VGW-M8XP

GO-2026-4711

SUSE-SU-2026:1135-1

Affected Products

Filebrowser

References · 150

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32758.json · Exploit
• https://github.com/filebrowser/filebrowser/commit/4bd7d69c82163b201a987e99c0c50d7ecc6ee5f1 · Patch
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-9f3r-2vgw-m8xp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32758 · Security Note
• https://osv.dev/vulnerability/GO-2026-4711 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32758 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9f3r-2vgw-m8xp · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/releases/tag/v2.62.0 · Note
• https://suse.com/security/cve/CVE-2026-33528 · Note
• https://suse.com/security/cve/CVE-2026-32828 · Note
• https://suse.com/security/cve/CVE-2026-33192 · Note
• https://suse.com/security/cve/CVE-2026-27889 · Note
• https://suse.com/security/cve/CVE-2026-32941 · Note