CVE-2026-28492

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.0, when a user creates a public share link for a directory, the withHashFile middleware in http/public.go uses filepath.Dir(link.Path) to compute the BasePathFs root. This sets the filesystem root to the parent directory instead of the shared directory itself, allowing anyone with the share link to browse and download files from all sibling directories. This issue has been patched in version 2.61.0.

• CWE-200

• https://github.com/filebrowser/filebrowser/commit/31194fb57a5b92e7155219d7ec7273028fcb2e83Patch
• https://github.com/filebrowser/filebrowser/releases/tag/v2.61.0Release Notes
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-mr74-928f-rw69Exploit, Mitigation, Vendor Advisory

Published

Mar 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28483Rejected reason: This CVE ID has been rejected.
• CVE-2026-28484Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-28485OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforc…7.8
• CVE-2026-28486OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a p…5.5
• CVE-2026-2849A vulnerability has been found in yeqifu warehouse up to aaf…6.3
• CVE-2026-28490Authlib is a Python library which builds OAuth and OpenID Co…6.5
• CVE-2026-28493ImageMagick is free and open-source software used for editin…6.5
• CVE-2026-28494ImageMagick is free and open-source software used for editin…7.1
• CVE-2026-28495GetSimple CMS is a content management system. The massiveAdm…8.8
• CVE-2026-28496FOSSBilling is a free, open-source billing and client manage…9.4
• CVE-2026-28497TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …9.1
• CVE-2026-28498Authlib is a Python library which builds OAuth and OpenID Co…7.5