https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T09:10:00.559103+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-35606 CVE-2026-35606 — File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check 2026-10-19T09:10:00.560124+00:00

Affected: filebrowser

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle) correctly verify this permission before serving content. A user with download: false can read any text file within their scope through two bypass paths. This vulnerability is fixed in 2.63.1.