high7.5
CVE-2026-35605
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.
Impact
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the Matches() function in rules/rules.go uses strings.HasPrefix() without a trailing directory separator when matching paths against access rules. A rule for /uploads also matches /uploads_backup/, granting or denying access to unintended directories. This vulnerability is fixed in 2.63.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/filebrowser/filebrowser/v2 | < 2.63.1 | 2.63.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Filebrowser | Filebrowser | before 2.63.1 |