N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-mr74-928f-rw69

GHSA-mr74-928f-rw69: FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory

Summary

When a user creates a public share link for a directory, the withHashFile middleware in http/public.go (line 59) uses filepath.Dir(link.Path) to compute the BasePathFs root. This sets the filesystem root to the parent directory instead of the shared directory itself, allowing anyone with the share link to browse and download files from all sibling directories.

Details

In http/public.go lines 52-64, the withHashFile function handles public share link requests:

basePath := link.Path    // e.g. "/documents/shared"
filePath := ""

if file.IsDir {
    basePath = filepath.Dir(basePath)  // BUG: becomes "/documents" (parent!)
    filePath = ifPath
}

d.user.Fs = afero.NewBasePathFs(d.user.Fs, basePath)

When a directory at /documents/shared is shared, filepath.Dir("/documents/shared") evaluates to "/documents". The BasePathFs is then rooted at the parent directory /documents/, giving the share link access to everything under /documents/ - not just the intended /documents/shared/.

This affects both publicShareHandler (directory listing via /api/public/share/{hash}) and publicDlHandler (file download via /api/public/dl/{hash}/path).

PoC

Set up filebrowser with a user whose scope contains:
- /documents/shared/public-file.txt (intended to be shared)
- /documents/secrets/passwords.txt (NOT intended to be shared)
- /documents/private/financial.csv (NOT intended to be shared)

Miggo Vulnerability Database

→

GHSA-mr74-928f-rw69

GHSA-mr74-928f-rw69:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/filebrowser/filebrowser/v2	go	<= 2.60.0	2.61.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch and vulnerability description clearly indicates that the withHashFile function in http/public.go is the source of the path traversal vulnerability. The vulnerability is caused by the incorrect use of filepath.Dir() on the path of a shared directory, which sets the base path for the share to the parent directory. This allows unauthorized access to files and directories outside the intended share scope. The provided patch confirms this by replacing the vulnerable call with filepath.Clean(link.Path), which correctly scopes the filesystem to the shared directory itself. The withHashFile function acts as a middleware for handlers like publicShareHandler and publicDlHandler, so it would be present in the runtime profile during exploitation.

Vulnerable functions

withHashFile

http/public.go

The function `withHashFile` in `http/public.go` is vulnerable to path traversal. When handling a shared directory, it incorrectly uses `filepath.Dir(basePath)` to determine the root of the shared filesystem. This sets the root to the parent directory of the intended shared folder, allowing an attacker to access sibling directories and files outside the intended scope by manipulating the path in the request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-mr74-928f-rw69: FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory

Summary

Details

PoC

GHSA-mr74-928f-rw69:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

GHSA-mr74-928f-rw69: FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory

Summary

Details

PoC

Impact

Recommended Fix

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-mr74-928f-rw69: FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory

Summary

Details

PoC

GHSA-mr74-928f-rw69:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

GHSA-mr74-928f-rw69: FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory

Summary

Details

PoC

Impact

Recommended Fix

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI