CVE-2026-28492CWE-200

File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory

High · published March 5, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.0, when a user creates a public share link for a directory, the withHashFile middleware in http/public.go uses filepath.Dir(link.Path) to compute the BasePathFs root. This sets the filesystem root to the parent directory instead of the shared directory itself, allowing anyone with the share link to browse and download files from all sibling directories. This issue has been patched in version 2.61.0.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00491 · 41.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-03-05T21:06Z
EPSS history
Timeline
  • 05 MAR 21:06Z
    File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory
    cvelistv5