CVE-2026-35606
File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
12th
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle) correctly verify this permission before serving content. A user with download: false can read any text file within their scope through two bypass paths. This vulnerability is fixed in 2.63.1.
| CWE | CWE-862 |
| Vendor | filebrowser |
| Product | filebrowser |
| Published | Apr 7, 2026 |
| Last Updated | Apr 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for filebrowser filebrowser
Be the first to know when new unknown vulnerabilities affecting filebrowser filebrowser are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
filebrowser / filebrowser
< 2.63.1