CVE-2026-54091: File Browser Authorization Bypass in Public Shares

Technical summary

File Browser versions prior to 2.63.6 contain an authorization bypass vulnerability in its public share handlers. The root cause is an improper path normalization issue: when a share is created, File Browser rebases the owner's filesystem root to the shared directory and then evaluates descendant paths against the owner's access control rules using the rebased relative path rather than the original path relative to the owner's scope. This mismatch allows an attacker to navigate past rules enforced at a higher level in the directory tree. The vulnerability manifests through unauthenticated access via the `GET /api/public/share/*` and `GET /api/public/dl/*` endpoints, enabling information disclosure of restricted files. The flaw is categorized as CWE-863 (Incorrect Authorization) and carries a CVSS v3.1 score of 7.5 (HIGH severity) due to the combination of network accessibility, low attack complexity, lack of authentication requirement, and high confidentiality impact.

Business impact

This vulnerability poses a significant compliance and data protection risk. Organizations using File Browser to share directories with external users while maintaining internal access restrictions face unintended exposure of sensitive files. The lack of authentication requirement means any person with a public share URL can bypass the owner's intended access controls, potentially exposing confidential documents, personal information, or proprietary data. For organizations subject to data protection regulations (GDPR, HIPAA, etc.), unauthorized access to restricted files through a shared link could trigger breach notification obligations and regulatory penalties. The reputational harm from data exposure, combined with the ease of exploitation, elevates business impact beyond the technical severity score.

Affected systems

File Browser versions prior to 2.63.6 are affected. The vulnerability is present in any deployment where public directory shares are configured with access control rules intended to restrict visibility of certain files or subdirectories. Organizations running File Browser for collaborative file sharing, particularly those exposing shares to external or semi-trusted users, face direct risk.

Exploitability

Exploitation requires only knowledge of a valid public share URL and a simple HTTP GET request. No authentication, special privileges, or complex interaction is necessary—an unauthenticated attacker can immediately enumerate restricted files and download them. Attack complexity is minimal and the attack surface is broad: any public share configured with access rules is a potential target. The barrier to exploitation is extremely low, making this a high-confidence vulnerability for attackers who discover or are given public share URLs.

Remediation

Upgrade File Browser to version 2.63.6 or later, which corrects the path evaluation logic to properly respect access control rules regardless of the share's directory location. Verify the patch against the vendor advisory before deployment. In the interim, organizations should audit existing public shares to identify which ones have access control rules configured, review access logs for any suspicious enumeration of restricted paths, and consider temporarily disabling public shares if they contain sensitive data with intended restrictions.

Patch guidance

Apply the vendor's patch to upgrade File Browser to version 2.63.6 or newer. Consult the official File Browser release notes and vendor advisory for specific upgrade procedures and compatibility notes. After patching, test the affected public shares to confirm that access rules are now properly enforced and that previously blocked paths remain inaccessible through the public share interface.

Detection guidance

Monitor access logs for the `GET /api/public/share/*` and `GET /api/public/dl/*` endpoints, particularly for requests targeting paths that should be restricted by the owner's access control rules. Look for patterns such as repeated attempts to access deeply nested subdirectories within a public share, or enumeration of directory structures that the owner has explicitly blocked. Implement baseline logging of all unauthenticated public share requests and establish alerts for access attempts to known-restricted paths. File integrity monitoring on sensitive files within shared directories can help detect unauthorized access retroactively.

Why prioritize this

This vulnerability merits immediate attention due to its combination of high severity (CVSS 7.5), trivial exploitability (no authentication required, low complexity), and direct impact on confidentiality. Organizations using File Browser's public share feature with access restrictions should treat this as a critical patching priority. The lack of authentication requirement means the attack surface is maximally exposed to any external party who discovers a public share URL. The fix is straightforward and available; delay in patching leaves sensitive data unnecessarily at risk.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with low attack complexity, no authentication requirement, and high confidentiality impact. The vulnerability does not require user interaction and does not affect integrity or availability, focusing solely on unauthorized information disclosure. The score accurately captures the ease and breadth of exploitability, though organizations storing highly sensitive data or subject to stringent compliance requirements may treat this as functionally critical despite the technical HIGH rating.

Frequently asked questions