https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 01:55:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-281132 EUVD-2026-281132 https://cve.radiocsirt.org/vuln/euvd-2026-281132 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35604 <p>File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user&#39;s Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner&#39;s current permissions. This vulnerability is fixed in 2.63.1.</p> <p>File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user&#39;s Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner&#39;s current permissions. This vulnerability is fixed in 2.63.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35604 https://cve.radiocsirt.org/vuln/ghsa-v9w4-gm2x-6rvf <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2</p> <p>When an admin revokes a user&#39;s Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner&#39;s current permissions. Verified with a running PoC against v2.62.2 (commit 860c19d).</p> <p>## Details</p> <p>Share creation (`http/share.go:21-29`) correctly checks permissions:</p> <p>func withPermShare(fn handleFunc) handleFunc { return withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) { if !d.user.Perm.Share || !d.user.Perm.Download { return http.StatusForbidden, nil } return fn(w, r, d) }) }</p> <p>But share access (`http/public.go:18-87`, `withHashFile`) does not:</p> <p>var withHashFile = func(fn handleFunc) handleFunc { return func(w http.ResponseWriter, r *http.Request, d *data) (int, error) { link, err := d.store.Share.GetByHash(id) // line 21: checks share exists authenticateShareRequest(r, link) // line 26: checks password user, err := d.store.Users.Get(...) // line 31: checks user exists d.user = user // line 36: sets user file, err := files.NewFileInfo(...) // line 38: gets file // MISSING: no check for d.user.Perm.Share or d.user.Perm.Download } }</p> <p>## Proof of Concept (runtime-verified)</p> <p># Step 1: Login as admi…</p> <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2</p> <p>When an admin revokes a user&#39;s Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner&#39;s current permissions. Verified with a running PoC against v2.62.2 (commit 860c19d).</p> <p>## Details</p> <p>Share creation (`http/share.go:21-29`) correctly checks permissions:</p> <p>func withPermShare(fn handleFunc) handleFunc { return withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) { if !d.user.Perm.Share || !d.user.Perm.Download { return http.StatusForbidden, nil } return fn(w, r, d) }) }</p> <p>But share access (`http/public.go:18-87`, `withHashFile`) does not:</p> <p>var withHashFile = func(fn handleFunc) handleFunc { return func(w http.ResponseWriter, r *http.Request, d *data) (int, error) { link, err := d.store.Share.GetByHash(id) // line 21: checks share exists authenticateShareRequest(r, link) // line 26: checks password user, err := d.store.Users.Get(...) // line 31: checks user exists d.user = user // line 36: sets user file, err := files.NewFileInfo(...) // line 38: gets file // MISSING: no check for d.user.Perm.Share or d.user.Perm.Download } }</p> <p>## Proof of Concept (runtime-verified)</p> <p># Step 1: Login as admi…</p> https://cve.radiocsirt.org/vuln/ghsa-v9w4-gm2x-6rvf