Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication, no known patched versions are available.
Problem types
CWE-305: Authentication Bypass by Primary Weakness
Product status
References
github.com/...rowser/security/advisories/GHSA-3v48-283x-f2w4
github.com/filebrowser/filebrowser/issues/5239
github.com/...rowser_Password_Protection_Of_Links_Bypassable