File Browser has an Authorization Policy Bypass in its Public Share Download Flow

Summary

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and below contain a permission enforcement bypass which allows users who are denied download privileges (perm.download = false) but granted share privileges (perm.share = true) to exfiltrate file content by creating public share links. While the direct raw download endpoint (/api/raw/) correctly enforces the download permission, the share creation endpoint only checks Perm.Share, and the public download handler (/api/public/dl/<hash>) serves file content without verifying that the original file owner has download permission. This means any authenticated user with share access can circumvent download restrictions by sharing a file and then retrieving it via the unauthenticated public download URL. The vulnerability undermines data-loss prevention and role-separation policies, as restricted users can publicly distribute files they are explicitly blocked from downloading directly. This issue has been fixed in version 2.62.0.

Timeline

1. Mar 19, 2026, 11:45 PM UTCCVE published
2. Mar 21, 2026, 3:03 AM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: partial

3. Mar 21, 2026, 3:04 AM UTCRecord last updated

Affected versions

• filebrowser filebrowser

  fixed in 2.62.0

• github.com/filebrowser/filebrowserGo

  All versions

• github.com/filebrowser/filebrowser/v2Go

  fixed in 2.62.0

• https://github.com/filebrowser/filebrowserGo

  through 2.61.0

References 3