Description

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T12:16:47.187Z",
  "pubdate": "2026-08-14T12:16:47.187Z",
  "executiveSummary": "A privilege escalation and isolation bypass vulnerability exists in File Browser versions prior to 2.63.20. The flaw resides within the proxy and hook authentication auto-provisioning paths, where the application fails to properly enforce the configured createUserDir isolation boundary. This failure results in an unintended server root scope assignment during user auto-provisioning. Consequently, authenticated attackers possessing valid upstream credentials can circumvent logical tenant boundaries, achieving unauthorized access to read, modify, delete, and share arbitrary files belonging to other users across the system. The risk implication is high, as multi-tenant deployments or environments utilizing upstream authentication proxies rely on createUserDir to segregate user storage spaces. Successful exploitation requires valid upstream-authenticated credentials but no prior administrative privileges, allowing malicious actors to leverage their legitimate session context to interact with the entire server filesystem scope rather than their restricted user directory.",
  "technicalDetails": "The root cause of the vulnerability stems from improper handling of user directory scoping logic within the proxy and hook authentication auto-provisioning mechanisms of File Browser versions prior to 2.63.20. When an external authentication method via proxy or hooks provisions a new user session or auto-registers a user, the application is expected to restrict the user's operational scope to their designated user-specific directory defined by the createUserDir configuration directive. However, due to a flaw in scope assignment during these specific authentication workflows, the application incorrectly assigns the server root scope to the newly provisioned or authenticated user session instead of the isolated subdirectory.\nThe attack flow begins when an adversary authenticates against the upstream identity provider or proxy mechanism, obtaining valid session credentials recognized by File Browser. Upon successful upstream authentication, File Browser initiates its auto-provisioning or login hook path. Due to the parsing and scope assignment logic error, the session is instantiated with elevated boundary privileges encompassing the entire server filesystem root. Armed with these valid upstream-authenticated credentials and the over-scoped session context, the attacker interacts with the File Browser API endpoints normally reserved for higher-privilege operations or intended solely for administrative oversight.\nThe vulnerable components are the authentication auto-provisioning paths handling proxy and hook integrations within File Browser. Network exposure includes any deployment exposing these authentication endpoints to users. While authentication is required—meaning unauthenticated external entities cannot directly exploit the flaw—any user who can successfully authenticate via the upstream proxy or hook mechanism inherits the over-scoped permissions. Post-exploitation impact includes complete confidentiality, integrity, and availability breaches of stored data, as the attacker can traverse, read, modify, delete, and share files belonging to distinct users who share the same File Browser instance, effectively neutralizing logical data segregation enforced by multi-tenant configurations."
}