CVE-2026-35606

MEDIUM

File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-35606 has a selected CVSS score of 5.3 (medium).

Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle) correctly verify this permission before serving content. A user with download: false can read any text file within their scope through two bypass paths. This vulnerability is fixed in 2.63.1.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 9, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

filebrowser

Browse filebrowser / filebrowser
CVE List< 2.63.1affected

github.com/filebrowser/filebrowser/v2

Browse Go / github.com/filebrowser/filebrowser/v2
GitHub AdvisoryBefore 2.63.1 · Fixed in 2.63.1affected

References

3