CVE-2026-35604

Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner's current permissions. This vulnerability is fixed in 2.63.1.

PUBLISHED Reserved 2026-04-03 | Published 2026-04-07 | Updated 2026-04-07 | Assigner GitHub_M

Problem types

CWE-863: Incorrect Authorization

Product status

References

github.com/...rowser/security/advisories/GHSA-v9w4-gm2x-6rvf

github.com/filebrowser/filebrowser/pull/5888

cve.org (CVE-2026-35604)

nvd.nist.gov (CVE-2026-35604)

Download JSON