GHSA-68j5-4m99-w9w9

Suggest an improvement
Source
https://github.com/advisories/GHSA-68j5-4m99-w9w9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-68j5-4m99-w9w9/GHSA-68j5-4m99-w9w9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-68j5-4m99-w9w9
Aliases
Published
2026-03-18T12:59:12Z
Modified
2026-09-10T03:50:59Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
File Browser has an Authorization Policy Bypass in Public Share Download Flow
Details

Summary

A permission enforcement flaw allows users without download privileges (download=false) to still expose and retrieve file content via public share links when they retain share privileges (share=true). This bypasses intended access control policy and enables unauthorized data exfiltration to unauthenticated users. Where download restrictions are used for data-loss prevention or role separation.

Details

The backend applies inconsistent authorization checks across download paths:

  • Direct raw download correctly enforces Perm.Download:
    • [raw.go](filebrowser/http/raw.go:82)
  • Share creation only enforces Perm.Share:
    • [share.go](filebrowser/http/share.go:21)
  • Public share/download handlers serve shared content without verifying owner Perm.Download:

As a result, a user who is blocked from direct downloads can create a share and obtain the same file via /api/public/dl/<hash>.

PoC

  1. Create a non-admin user with:
  • perm.share = true
  • perm.download = false
  1. Login as that user and upload a PDF file:
  • POST /api/resources/nodl_secret_<rand>.pdf with Content-Type: application/pdf
  1. Verify direct raw download is denied:
  • GET /api/raw/nodl_secret_<rand>.pdf
  • Expected and observed: 202 Accepted (blocked)
  1. Create share for same file:
  • POST /api/share/nodl_secret_<rand>.pdf
  • Observed: 200, response includes hash (example: qxfK3JMG)
  1. Download publicly without authentication:
  • GET /api/public/dl/<hash>
  • Observed (vulnerable): 200, Content-Type: application/pdf, and PDF bytes are returned

Live evidence captured (March 1, 2026):

  • create user: 201
  • create file: 200
  • direct /api/raw: 202 Accepted
  • create share: 200
  • public download /api/public/dl/mxK-ppZb: 200
  • public download content-type: application/pdf
  • public download body length: 327 bytes

Impact

This is an access control / authorization policy bypass vulnerability.

  • Who can exploit: Any authenticated user granted share=true but denied download.
  • Who is impacted: Operators and organizations relying on download restrictions to prevent data export.
  • What can happen: Restricted users can still distribute and retrieve files publicly, including unauthenticated access through share URLs.
Database specific 
{
    "cwe_ids":  [
        "CWE-284",
        "CWE-639",
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-18T12:59:12Z",
    "nvd_published_at":  "2026-03-20T00:16:17Z",
    "severity":  "MODERATE"
}
References

Affected packages

Go / https://github.com/filebrowser/filebrowser

Package

Name
https://github.com/filebrowser/filebrowser
View open source insights on deps.dev
Purl
pkg:golang/https:/github.com/filebrowser/filebrowser

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
2.61.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-68j5-4m99-w9w9/GHSA-68j5-4m99-w9w9.json"