CVE-2026-32758

Katalog CVE

CVSS 6.5 · Medium EPSS 0,44%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada filebrowser. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.2 and below are vulnerable to Path Traversal through the resourcePatchHandler (http/resource.go). The destination path in resourcePatchHandler is validated against access rules before being cleaned/normalized, while the actual file operation calls path.Clean() afterward—resolving .. sequences into a different effective path. This allows an authenticated user with Create or Rename permissions to bypass administrator-configured deny rules (both prefix-based and regex-based) by injecting .. sequences in the destination parameter of a PATCH request. As a result, the user can write or move files into any deny-rule-protected path within their scope. However, this cannot be used to escape the user's BasePathFs scope or read from restricted paths. This issue has been fixed in version 2.62.0.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-9f3r-2vgw-m8xp mitigasi · advisory vendor
• https://github.com/filebrowser/filebrowser/commit/4bd7d69c82163b201a987e99c0c50d7ecc6ee5f1 patch
• https://github.com/filebrowser/filebrowser/releases/tag/v2.62.0 product · release notes