https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:01:42 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-00103 bdu:2026-00103 https://cve.radiocsirt.org/vuln/bdu:2026-00103 https://cve.radiocsirt.org/vuln/cnvd-2025-22703 cnvd-2025-22703 https://cve.radiocsirt.org/vuln/cnvd-2025-22703 https://cve.radiocsirt.org/vuln/euvd-2026-248971 EUVD-2026-248971 https://cve.radiocsirt.org/vuln/euvd-2026-248971 https://cve.radiocsirt.org/vuln/fkie_cve-2025-52996 <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication, no known patched versions are available.</p> <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication, no known patched versions are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-52996 https://cve.radiocsirt.org/vuln/ghsa-3v48-283x-f2w4 <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser</p> <p>## Summary ##</p> <p>Files managed by the *File Browser* can be shared with a link to external persons. While the application allows protecting those links with a password, the implementation is error-prone, making an incidental unprotected sharing of a file possible.</p> <p>## Impact ##</p> <p>File owners might rest in the assumption that their shared files are only accessible to persons knowing the defined password, giving them a false sense of security. Meanwhile, attackers gaining access to the unprotected link can use this information alone to download the possibly sensitive file.</p> <p>## Vulnerability Description ##</p> <p>When sharing a file, the user is presented with a dialog asking for an optional password to protect the file share. The assumption of the user at this point would be, that the shared file won&#39;t be accessible without knowledge of the password. After clicking on `SHARE` the following dialog opens allowing the file&#39;s owner to copy the share-link:</p> <p></p> <p>In fact, there is not one, but two links offered: A `Download Link` and an unnamed second one. They have the following format:</p> <p>* http://filebrowser.local:8080/share/6Gtw0xAw * http://filebrowser.local:8080/api/public/dl/6Gtw0xAw/dummy1.pdf?token=voDK6j[...]</p> <p>Apparently, the first of the two share links is that one that users are supposed to actually share, while the second one is a direct download link not protected by the password. This behavior…</p> <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser</p> <p>## Summary ##</p> <p>Files managed by the *File Browser* can be shared with a link to external persons. While the application allows protecting those links with a password, the implementation is error-prone, making an incidental unprotected sharing of a file possible.</p> <p>## Impact ##</p> <p>File owners might rest in the assumption that their shared files are only accessible to persons knowing the defined password, giving them a false sense of security. Meanwhile, attackers gaining access to the unprotected link can use this information alone to download the possibly sensitive file.</p> <p>## Vulnerability Description ##</p> <p>When sharing a file, the user is presented with a dialog asking for an optional password to protect the file share. The assumption of the user at this point would be, that the shared file won&#39;t be accessible without knowledge of the password. After clicking on `SHARE` the following dialog opens allowing the file&#39;s owner to copy the share-link:</p> <p></p> <p>In fact, there is not one, but two links offered: A `Download Link` and an unnamed second one. They have the following format:</p> <p>* http://filebrowser.local:8080/share/6Gtw0xAw * http://filebrowser.local:8080/api/public/dl/6Gtw0xAw/dummy1.pdf?token=voDK6j[...]</p> <p>Apparently, the first of the two share links is that one that users are supposed to actually share, while the second one is a direct download link not protected by the password. This behavior…</p> https://cve.radiocsirt.org/vuln/ghsa-3v48-283x-f2w4 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1 <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1