Path Traversal Vulnerability in File Browser by File Browser
CVE-2026-35605

6.3MEDIUM

Key Information:

Vendor

Filebrowser

Status
Filebrowser
Vendor
CVE Published:
7 April 2026

What is CVE-2026-35605?

The vulnerability in File Browser arises from improper path matching in the Matches() function within rules/rules.go. Specifically, the function utilizes strings.HasPrefix() without ensuring a trailing directory separator, which permits unintended access to directories such as /uploads_backup/ when access rules are established for /uploads. This flaw compromises the integrity of access controls, allowing for unauthorized file access and manipulation prior to version 2.63.1, which has addressed this security issue.

Affected Version(s)

filebrowser < 2.63.1

References

https://github.com/filebrowser/filebrowser/security/advis...
x_refsource_CONFIRM
https://github.com/filebrowser/filebrowser/pull/5889
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.