CVE-2026-35606 Details
Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle) correctly verify this permission before serving content. A user with download: false can read any text file within their scope through two bypass paths. This vulnerability is fixed in 2.63.1.
A vulnerability in File Browser prior to version 2.63.1 allows users with 'download: false' permission to access full text file content through the '/api/resources' endpoint. The issue arises because the 'resourceGetHandler' in 'http/resource.go' returns text content without verifying the necessary download permission. In contrast, the other content-serving endpoints ('/api/raw', '/api/preview', '/api/subtitle') properly check this permission before delivering content. This flaw enables unauthorized users to read any text file within their scope, potentially exposing sensitive information such as source code, configuration files, credentials, and API tokens stored as text.
Users are advised to update File Browser to version 2.63.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-67cg-cpj7-qgc9 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-67cg-cpj7-qgc9 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| filebrowser filebrowser | <= 2.63.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | New CVE Received | [email protected] |