Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST /api/share/{path} and GET /api/shares to expose password_hash and the bypass token, while an administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares. This issue is fixed in version 2.63.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-18T16:18:11.797Z",
  "pubdate": "2026-08-18T16:18:11.797Z",
  "executiveSummary": "An information disclosure vulnerability exists in File Browser prior to version 2.63.17, specifically within the sharing handling mechanisms.\nThe flaw allows unauthorized exposure of sensitive cryptographic material, including password_hash and bypass tokens, through specific API endpoints.\nThe affected systems include File Browser instances running versions prior to 2.63.17 where the Link storage struct is directly serialized by sharePostHandler, shareListHandler, and shareGetsHandler via renderJSON.\nThe risk implications are severe, as attackers or privileged administrators can harvest internal secrets enabling offline password cracking against user shares and direct unauthorized access to protected shares.\nAttacker capabilities range from extracting standard user share secrets via POST /api/share/{path} and GET /api/shares to global secret retrieval by administrators across all user shares.\nNo complex exploitation requirements are stated beyond interacting with the vulnerable API endpoints exposed by the application.",
  "technicalDetails": "The vulnerability resides in the sharing management subsystem of File Browser, specifically affecting the Link storage struct handling within sharePostHandler, shareListHandler, and shareGetsHandler functions.\nThe root cause is the direct serialization of the Link storage struct through the renderJSON function without proper sanitization or field exclusion, leading to the inclusion of internal security fields in HTTP responses.\nThe vulnerable components include the API endpoints POST /api/share/{path} and GET /api/shares, which transmit the serialized Link objects containing sensitive authentication material.\nThe affected software versions encompass all releases of File Browser prior to version 2.63.17.\nThe attack flow proceeds as follows: An authenticated or unauthenticated user (depending on endpoint constraints) initiates a request to POST /api/share/{path} or GET /api/shares. The backend application invokes the vulnerable sharePostHandler, shareListHandler, or shareGetsHandler functions. These handlers serialize the Link storage struct using renderJSON. The resulting JSON payload directly incorporates sensitive internal fields, specifically password_hash and the bypass token.\nUpon receiving the response, an attacker extracts the exposed password_hash values, enabling offline brute-force or dictionary-based password cracking attacks to recover plaintext user credentials.\nAdditionally, attackers leverage the exposed bypass token to achieve direct access to password-protected shares, completely bypassing the intended authentication controls.\nFurthermore, users with administrative privileges can retrieve these sensitive secrets for every user's shares across the entire instance, exacerbating the blast radius of potential credential compromise.\nThe payload behavior is strictly informational from the server perspective, but the resulting client-side data exposure provides all necessary primitives for subsequent authentication bypass and offline credential cracking."
}