PT-2026-26089 · Unknown · Filebrowser

Ahmad-Jarwan · Published 2026-03-18 · Updated 2026-04-07 · CVE-2026-32761

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions File Browser versions 2.61.0 and below

Description File Browser is a file managing interface that allows users to upload, delete, preview, rename, and edit files. A permission enforcement issue exists where users with share privileges (perm.share = true) but without download privileges (perm.download = false) can bypass download restrictions and exfiltrate file content. This is achieved by creating public share links and then retrieving the files via the public download handler ('/api/public/dl/'). The direct raw download endpoint ('/api/raw/') correctly enforces download permissions, but the share creation endpoint only checks share permissions. The public download handler serves file content without verifying the original file owner's download permission. This bypass undermines data-loss prevention and role-separation policies, allowing restricted users to publicly distribute files they are explicitly blocked from downloading directly. The backend applies inconsistent authorization checks across download paths, specifically in raw.go, share.go, and public.go. A proof-of-concept demonstrates that a user without download permissions can upload a file, create a share, and then download the file publicly using the generated hash.

Recommendations Versions prior to 2.62.0 are affected. Update to version 2.62.0 or later to resolve this issue.

Exploit

Fix

IDOR

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-284

CWE-863

Related Identifiers

CVE-2026-32761

GHSA-68J5-4M99-W9W9

GO-2026-4738

Affected Products

Filebrowser

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32761.json · Exploit
• https://github.com/filebrowser/filebrowser/commit/09a26166b4f79446e7174c017380f6db45444e32 · Patch
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-68j5-4m99-w9w9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32761 · Security Note
• https://osv.dev/vulnerability/GO-2026-4738 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-68j5-4m99-w9w9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32761 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/releases/tag/v2.62.0 · Note
• https://twitter.com/CVEnew/status/2034841491005386851 · Twitter Post
• https://twitter.com/cyberbivash/status/2034812110996148436 · Twitter Post