CVE-2026-62684: File Browser Information Disclosure Flaw

CVE-2026-62684 Overview

CVE-2026-62684 is an information disclosure vulnerability [CWE-200] in File Browser, an open source web interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON. This causes POST /api/share/{path} and GET /api/shares to expose the password_hash and bypass token for shares. An administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares.

Critical Impact
Authenticated users can retrieve share password_hash values and bypass tokens through the share API, and administrators can enumerate these secrets across all users' shares, allowing offline cracking and unauthorized access to password-protected shares.

Affected Products

File Browser (filebrowser/filebrowser) versions prior to 2.63.17
Deployments exposing /api/share/{path} and /api/shares endpoints
Multi-tenant File Browser instances with administrator accounts

Discovery Timeline

2026-08-18 - CVE-2026-62684 published to NVD
2026-08-18 - Last updated in NVD database
v2.63.17 - Fix released by the File Browser project (GitHub Release v2.63.17)

Technical Details for CVE-2026-62684

Vulnerability Analysis

The flaw arises from unfiltered serialization of an internal storage struct across the share API. Handlers sharePostHandler, shareListHandler, and shareGetsHandler pass the Link struct directly to renderJSON. Because the struct includes sensitive fields such as password_hash and the bypass token, the API response leaks these secrets to any caller authorized to view the share.

An authenticated user can obtain the hash of their own share password and the bypass token via POST /api/share/{path}. Administrators listing shares through GET /api/shares receive password_hash and token values for every user. This enables offline password cracking against the leaked hashes and direct navigation to password-protected shares using the bypass token, defeating the confidentiality control the password was meant to enforce.

Root Cause

The root cause is missing separation between internal persistence models and API response models. The Link struct used for storage was serialized wholesale as the API response body, so secret fields were emitted alongside intended public fields such as path, expire, userID, and username.

Attack Vector

An attacker with valid credentials issues a request against the share API and reads the JSON response. An administrator account amplifies the impact by returning secrets for every share on the instance. No user interaction is required beyond a normal API call.

typescript

// Patch: frontend/src/types/api.d.ts
   path: string;
   expire?: any;
   userID?: number;
-  token?: string;
+  hasPassword?: boolean;
   username?: string;
 }

Source: GitHub Commit ec13054

The patch removes the token field from the client-facing API type and replaces it with a boolean hasPassword flag. The frontend was correspondingly updated so UI logic depends on link.hasPassword rather than on the raw link.password_hash:

text

                 class="action"
                 :aria-label="$t('buttons.copyDownloadLinkToClipboard')"
                 :title="$t('buttons.copyDownloadLinkToClipboard')"
-                :disabled="!!link.password_hash"
+                :disabled="!!link.hasPassword"
                 @click="copyToClipboard(buildDownloadLink(link))"
               >
                 <i class="material-icons">content_paste_go</i>

Source: GitHub Commit ec13054

Detection Methods for CVE-2026-62684

Indicators of Compromise

API responses from /api/share/{path} or /api/shares containing password_hash or token fields, indicating an unpatched instance.
Unexpected access to password-protected shares without a preceding password prompt or verification event in application logs.
Administrator accounts issuing bulk GET /api/shares requests followed by external access to previously protected share URLs.

Detection Strategies

Inspect File Browser HTTP responses in a proxy or WAF for JSON keys password_hash and token under share endpoints.
Correlate share listing calls with subsequent share access from new IP addresses or user agents.
Track deployed File Browser versions across the environment and flag any instance below 2.63.17.

Monitoring Recommendations

Enable request and response logging for /api/share* routes and retain logs long enough to support offline hash-cracking investigations.
Alert on outbound transfer of File Browser API responses to non-corporate destinations.
Monitor administrator sessions for anomalous share enumeration activity.

How to Mitigate CVE-2026-62684

Immediate Actions Required

Upgrade File Browser to version 2.63.17 or later, which stops serializing password_hash and the bypass token in share API responses.
Rotate all existing share passwords, because previously issued hashes and bypass tokens must be considered compromised.
Revoke and recreate active shares to invalidate any bypass tokens that may have been captured before patching.

Patch Information

The fix is included in File Browser v2.63.17. Full technical context is available in the GHSA-833g-cqhp-h72j security advisory and the remediation commit ec13054.

Workarounds

Restrict File Browser to trusted networks or authenticated reverse proxies until the patch can be applied.
Limit administrator account usage and reduce the number of privileged users who can call GET /api/shares.
Disable password-protected sharing where feasible, and rely on user-level access controls until upgrading.

bash

# Example: upgrade File Browser container to the patched release
docker pull filebrowser/filebrowser:v2.63.17
docker stop filebrowser && docker rm filebrowser
docker run -d --name filebrowser \
  -v /srv/filebrowser/data:/srv \
  -v /srv/filebrowser/config/filebrowser.db:/database.db \
  -p 8080:80 \
  filebrowser/filebrowser:v2.63.17