Vulnerability · Published Jun 25, 2026 · Assigned by GitHub_M
CVE-2026-54091File Browser: Incorrect access control in public directory shares via rule path rebasing
High 7.5
In plain English
A high-severity incorrect authorization in filebrowser from filebrowser. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, File Browser's public share handlers rebase the share owner's filesystem root to the shared directory and then evaluate descendant paths against the owner's global and per-user rules using the rebased relative path instead of the original path relative to the owner's scope. As a result, an attacker who knows a public directory share URL can access files and subdirectories that the owner explicitly blocked with rules, as long as those blocked paths are located underneath the shared directory. In the simplest case this is an unauthenticated information disclosure through `GET /api/public/share/*` and `GET /api/public/dl/*`. This vulnerability is fixed in 2.63.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/filebrowser/filebrowser | no fix listed | GO-2026-5458 |
| Go | github.com/filebrowser/filebrowser/v2 | 2.63.6 | GHSA-j9jx-hp4c-ghhh |
| Go | github.com/filebrowser/filebrowser/v2 | 2.63.6 | GO-2026-5458 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| filebrowser | filebrowser | < 2.63.6 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N