CVE-2026-28492
File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.0, when a user creates a public share link for a directory, the withHashFile middleware in http/public.go uses filepath.Dir(link.Path) to compute the BasePathFs root. This sets the filesystem root to the parent directory instead of the shared directory itself, allowing anyone with the share link to browse and download files from all sibling directories. This issue has been patched in version 2.61.0.
| CWE | CWE-200 |
| Vendor | filebrowser |
| Product | filebrowser |
| Published | Mar 5, 2026 |
| Last Updated | Mar 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for filebrowser filebrowser
Be the first to know when new unknown vulnerabilities affecting filebrowser filebrowser are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
filebrowser / filebrowser
< 2.61.0