EUVD-2026-290280

fkie_cve-2026-35606

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle) correctly verify this permission before serving content. A user with download: false can read any text file within their scope through two bypass paths. This vulnerability is fixed in 2.63.1.

GHSA-67cg-cpj7-qgc9 — File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check

Affected: Go: github.com/filebrowser/filebrowser/v2

## Summary

The `resourceGetHandler` in `http/resource.go` returns full text file content without checking the `Perm.Download` permission flag. All three other content-serving endpoints (`/api/raw`, `/api/preview`, `/api/subtitle`) correctly verify this permission before serving content. A user with `download: false` can read any text file within their scope through two bypass paths.

Confirmed on v2.62.2 (commit 860c19d).

## Root Cause

`http/resource.go` line 26-33 hardcodes `Content: true` in the FileOptions without checking download permission:

file, err := files.NewFileInfo(&files.FileOptions{ ... Content: true, // Always loads text content, no permission check })

Lines 44-63: the `X-Encoding: true` header path reads the entire file and returns raw bytes as `application/octet-stream`, also without any download check.

Compare with the three protected endpoints:

// raw.go:83-85 if !d.user.Perm.Download { return http.StatusAccepted, nil }

// preview.go:38-40 if !d.user.Perm.Download { return http.StatusAccepted, nil }

// subtitle.go:13-15 if !d.user.Perm.Download { return http.StatusAccepted, nil }

## PoC

Tested on filebrowser v2.62.2, built from HEAD.

# Create user with download=false via CLI filebrowser users add restricted testuser123456 --perm.download=false

# Login TOKEN=$(curl -s http://HOST/api/login -d '{"username":"restricted","password":"testuser123456"}')

# BLOCKED: /api/raw corr…

Most recent entries from all

EUVD-2026-290280

fkie_cve-2026-35606

GHSA-67cg-cpj7-qgc9 — File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check