Vulnerability · Published Mar 5, 2026 · Assigned by GitHub_M
CVE-2026-28492File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory
High 7.1
In plain English
A high-severity information exposure in filebrowser from filebrowser. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.0, when a user creates a public share link for a directory, the withHashFile middleware in http/public.go uses filepath.Dir(link.Path) to compute the BasePathFs root. This sets the filesystem root to the parent directory instead of the shared directory itself, allowing anyone with the share link to browse and download files from all sibling directories. This issue has been patched in version 2.61.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/filebrowser/filebrowser | no fix listed | GO-2026-4585 |
| Go | github.com/filebrowser/filebrowser/v2 | 2.61.0 | GHSA-mr74-928f-rw69 |
| Go | github.com/filebrowser/filebrowser/v2 | 2.61.0 | GO-2026-4585 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| filebrowser | filebrowser | < 2.61.0 |
Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N