Most recent entries from all

EUVD-2026-276765

fkie_cve-2026-32758

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.2 and below are vulnerable to Path Traversal through the resourcePatchHandler (http/resource.go). The destination path in resourcePatchHandler is validated against access rules before being cleaned/normalized, while the actual file operation calls path.Clean() afterward—resolving .. sequences into a different effective path. This allows an authenticated user with Create or Rename permissions to bypass administrator-configured deny rules (both prefix-based and regex-based) by injecting .. sequences in the destination parameter of a PATCH request. As a result, the user can write or move files into any deny-rule-protected path within their scope. However, this cannot be used to escape the user's BasePathFs scope or read from restricted paths. This issue has been fixed in version 2.62.0.

GHSA-9f3r-2vgw-m8xp — File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter

Affected: Go: github.com/filebrowser/filebrowser/v2

## Description

The `resourcePatchHandler` in `http/resource.go` validates the destination path against configured access rules before the path is cleaned/normalized. The rules engine (`rules/rules.go`) uses literal string prefix matching (`strings.HasPrefix`) or regex matching against the raw path. The actual file operation (`fileutils.Copy`, `patchAction`) subsequently calls `path.Clean()` which resolves `..` sequences, producing a different effective path than the one validated.

This allows an authenticated user with Create or Rename permissions to bypass administrator-configured deny rules by including `..` (dot-dot) path traversal sequences in the `destination` query parameter of a PATCH request.

## Steps to Reproduce

### 1. Verify the rule works normally

```bash # This should return 403 Forbidden curl -X PATCH \ -H "X-Auth: <alice_jwt>" \ "http://host/api/resources/public/test.txt?action=copy&destination=%2Frestricted%2Fcopied.txt" ```

### 2. Exploit the bypass

```bash # This should succeed despite the deny rule curl -X PATCH \ -H "X-Auth: <alice_jwt>" \ "http://host/api/resources/public/test.txt?action=copy&destination=%2Fpublic%2F..%2Frestricted%2Fcopied.txt" ```

### 3. Result

The file `test.txt` is copied to `/restricted/copied.txt` despite the deny rule for `/restricted/`.

## Root Cause Analysis

In `http/resource.go:209-257`:

```go dst := r.URL.Query().Get("destination") // line 212 dst, err := url.QueryUnescape(dst) // line 214…