PT-2026-3502 · Unknown · Filebrowser

Guchihacker · Published 2026-01-19 · Updated 2026-02-06 · CVE-2026-23849

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.55.0

Description File Browser provides a file managing interface for tasks like uploading, deleting, and editing files. A flaw in the JSONAuth.Auth function allows unauthenticated attackers to identify valid usernames by observing the response time of the /api/login endpoint. This is possible because the authentication logic has a "short-circuit" evaluation. When a username is not found, the function returns quickly, but when a username exists, a slower password verification process using users.CheckPwd is executed, creating a measurable timing difference.

Recommendations Update to version 2.55.0 or later.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-208

CWE-203

Related Identifiers

CVE-2026-23849

GHSA-43MM-M3H2-3PRC

GO-2026-4344

SUSE-SU-2026:0403-1

Affected Products

Filebrowser

References · 89

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23849.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-23849 · Security Note
• https://osv.dev/vulnerability/GO-2026-4344 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23849 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-43mm-m3h2-3prc · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/commit/24781badd413ee20333aba5cce1919d676e01889 · Note
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-43mm-m3h2-3prc · Note
• https://suse.com/security/cve/CVE-2026-25499 · Note
• https://suse.com/security/cve/CVE-2026-1580 · Note
• https://suse.com/security/cve/CVE-2026-22808 · Note
• https://suse.com/security/cve/CVE-2023-43634 · Note
• https://suse.com/security/cve/CVE-2025-22873 · Note
• https://suse.com/security/cve/CVE-2023-43633 · Note