Most recent entries from all

bdu:2026-00103

2026-10-03T17:30:56.295841+00:00

bdu:2026-00103

cnvd-2025-22703

2026-10-03T17:30:56.295890+00:00

cnvd-2025-22703

EUVD-2026-248971

2026-10-03T17:30:56.295907+00:00

EUVD-2026-248971

fkie_cve-2025-52996

2026-10-03T17:30:56.295919+00:00

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication, no known patched versions are available.

GHSA-3v48-283x-f2w4 — File Browser's password protection of links is bypassable

2026-10-03T17:30:56.295952+00:00

Affected: Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser

## Summary ##

Files managed by the *File Browser* can be shared with a link to external persons. While the application allows protecting those links with a password, the implementation is error-prone, making an incidental unprotected sharing of a file possible.

## Impact ##

File owners might rest in the assumption that their shared files are only accessible to persons knowing the defined password, giving them a false sense of security. Meanwhile, attackers gaining access to the unprotected link can use this information alone to download the possibly sensitive file.

## Vulnerability Description ##

When sharing a file, the user is presented with a dialog asking for an optional password to protect the file share. The assumption of the user at this point would be, that the shared file won't be accessible without knowledge of the password. After clicking on `SHARE` the following dialog opens allowing the file's owner to copy the share-link:

![image](https://github.com/user-attachments/assets/f3add074-40ac-4367-a538-ede5bb526916)

In fact, there is not one, but two links offered: A `Download Link` and an unnamed second one. They have the following format:

* http://filebrowser.local:8080/share/6Gtw0xAw * http://filebrowser.local:8080/api/public/dl/6Gtw0xAw/dummy1.pdf?token=voDK6j[...]

Apparently, the first of the two share links is that one that users are supposed to actually share, while the second one is a direct download link not protected by the password. This behavior…

openSUSE-SU-2025:15405-1 — govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media

2026-10-03T17:30:56.296017+00:00

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media