Threats affecting pkg:github/filebrowser/filebrowser

FileBrowser versions prior to 2.63.19 contain a vulnerability in the TUS resumable-upload PATCH endpoint where the declared Upload-Length is not enforced. This allows authenticated users to send oversized request bodies, writing arbitrary data to disk beyond the declared length. The consequence is potential exhaustion of disk space, leading to service unavailability.

File Browser versions prior to 2.63.20 contain a vulnerability where the createUserDir isolation is not enforced in proxy and hook authentication auto-provisioning paths. This flaw allows attackers with valid upstream-authenticated credentials to access and manipulate files of other users by exploiting improper server root scope assignment. The vulnerability has a high severity rating with a CVSS score of 8.8.

FileBrowser versions before 2.63.19 have a vulnerability related to case-insensitive filesystems. When self-registration is enabled with Signup and CreateUserDir, usernames differing only by letter case can map to the same physical home directory on case-insensitive filesystems like Windows/NTFS. This allows a second user to access, modify, or delete files of another user without prior authentication or victim interaction.

filebrowser versions prior to v2.63.21 do not properly canonicalize file paths before applying access control rules. This flaw allows authenticated users to bypass administrator-defined deny rules by using alternate path representations, such as case variants or backslash separators, to access files that should be denied.

filebrowser versions before 2.63.19 have a permission bypass vulnerability in the /api/resources endpoint. Specifically, the checksum query branch reads and returns file digests without enforcing the Perm.Download permission. This allows authenticated users without download rights to obtain content hashes of files within their scope, potentially confirming file contents or detecting changes. This issue is a partial fix of a previous vulnerability (CVE-2026-35606) and does not bypass scope or path authorization controls.

filebrowser versions prior to 2.63.19 have a vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with Create permission to delete arbitrary files outside their allowed scope by exploiting a symlink attack during the cache TTL window.

File Browser versions 2.50.0 through 2.63.21 contain a vulnerability where JWT expiration is not validated if proxy authentication is configured with a non-default logout page. This allows attackers with previously valid tokens to access protected and administrative routes indefinitely and to renew expired tokens via the renewal endpoint.

File Browser versions prior to 2.63.22 have a vulnerability where access rules for descendant files and directories are not properly validated during recursive copy, rename, and delete operations. This allows authenticated users to bypass path-based access controls by manipulating allowed parent directories to affect denied files, compromising confidentiality and integrity.