The vulnerability arises from the use of a simple string prefix check (strings.HasPrefix) to verify that a requested file path is within a user's assigned BasePath during share creation or update. Because this check does not account for directory separators, an attacker with a BasePath of '/base' can specify a path like '/base2/secret.txt', which incorrectly passes the prefix check. Consequently, the attacker can create share links to files outside their authorized directory. The share download and listing handlers serve these files without revalidating directory scope, enabling unauthorized access. The flaw is due to CWE-639 (Authorization Bypass Through User-Controlled Key).

This vulnerability allows an attacker with legitimate sharing permissions to bypass directory restrictions and access arbitrary files outside their assigned base directory. It breaks data isolation guarantees by enabling unauthorized read access to sensitive files belonging to other tenants or system areas. The impact is limited to confidentiality (read access), with no integrity or availability impact reported. The severity is moderate due to the requirement of authenticated user privileges and the lack of remote unauthenticated exploitation.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Recommended mitigation includes replacing the flawed strings.HasPrefix check with a canonical path containment validation that is separator-aware, such as verifying that the target path equals the base path or starts with the base path plus a directory separator. Implement a centralized utility function to consistently validate path containment across all share creation, update, and access handlers to prevent regressions.