Description (CNA)
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle) correctly verify this permission before serving content. A user with download: false can read any text file within their scope through two bypass paths. This vulnerability is fixed in 2.63.1.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| filebrowser / filebrowser | affected < 2.63.1 |
CWE
CWE-862
References
ADP enrichment
No English description supplied.