https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:14:25 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267761 EUVD-2026-267761 https://cve.radiocsirt.org/vuln/euvd-2026-267761 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25890 <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application&#39;s &#34;Disallow&#34; file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files. This vulnerability is fixed in 2.57.1.</p> <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application&#39;s &#34;Disallow&#34; file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files. This vulnerability is fixed in 2.57.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25890 https://cve.radiocsirt.org/vuln/ghsa-4mh3-h929-w968 <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2</p> <p>### Summary An authenticated user can bypass the application&#39;s &#34;Disallow&#34; file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files.</p> <p>### Details The vulnerability allows users to bypass &#34;Disallow&#34; rules defined by administrators.</p> <p>The issue stems from how the application handles URL path normalization and rule matching:</p> <p>1. Router Configuration: The router in `http/http.go` is configured with `r.SkipClean(true)`. This prevents the automatic collapse of multiple slashes (e.g., // becoming /) before the request reaches the handler. 2. Insecure Rule Matching: The rule enforcement logic in `rules/rules.go` relies on a simple string prefix match: `strings.HasPrefix(path, r.Path)`. If a rule disallows /private, a request for //private fails this check because //private does not strictly start with /private. 3. Filesystem Resolution: After bypassing the rule check, the non-normalized path is passed to the filesystem. The filesystem treats the multiple slashes as a single separator, successfully resolving //private/secret.txt and serving the file.</p> <p>### PoC [Python minimal PoC](https://github.com/user-attachments/files/24823114/poc.py)</p> <p>The following steps demonstrate the vulnerability: 1. Setup: - Admin user creates a folder /private and adds a file /private/secret.txt. &lt;img wi…</p> <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2</p> <p>### Summary An authenticated user can bypass the application&#39;s &#34;Disallow&#34; file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files.</p> <p>### Details The vulnerability allows users to bypass &#34;Disallow&#34; rules defined by administrators.</p> <p>The issue stems from how the application handles URL path normalization and rule matching:</p> <p>1. Router Configuration: The router in `http/http.go` is configured with `r.SkipClean(true)`. This prevents the automatic collapse of multiple slashes (e.g., // becoming /) before the request reaches the handler. 2. Insecure Rule Matching: The rule enforcement logic in `rules/rules.go` relies on a simple string prefix match: `strings.HasPrefix(path, r.Path)`. If a rule disallows /private, a request for //private fails this check because //private does not strictly start with /private. 3. Filesystem Resolution: After bypassing the rule check, the non-normalized path is passed to the filesystem. The filesystem treats the multiple slashes as a single separator, successfully resolving //private/secret.txt and serving the file.</p> <p>### PoC [Python minimal PoC](https://github.com/user-attachments/files/24823114/poc.py)</p> <p>The following steps demonstrate the vulnerability: 1. Setup: - Admin user creates a folder /private and adds a file /private/secret.txt. &lt;img wi…</p> https://cve.radiocsirt.org/vuln/ghsa-4mh3-h929-w968