GHSA-5Q48-Q4FM-G3M6

Vulnerability from github – Published: 2026-04-08 00:04 – Updated: 2026-04-08 00:04
VLAI
Summary
File Browser has an access rule bypass via HasPrefix without trailing separator in path matching
Details

Hi,

The Matches() function in rules/rules.go uses strings.HasPrefix() without a trailing directory separator when matching paths against access rules. A rule for /uploads also matches /uploads_backup/, granting or denying access to unintended directories. Verified against v2.62.2 (commit 860c19d).

Details

At rules/rules.go:29-35:

func (r *Rule) Matches(path string) bool {
    if r.Regex {
        return r.Regexp.MatchString(path)
    }
    return strings.HasPrefix(path, r.Path)
}

When a rule has Path: "/uploads", any path starting with /uploads matches, including /uploads_backup/secret.txt. The regex variant at line 31 uses proper matching, but the non-regex path uses a prefix check without ensuring the match ends at a directory boundary.

The Check() function at http/data.go:29-48 iterates all rules with last-match-wins semantics. No secondary validation exists beyond this prefix check.

PoC

Admin configures: allow rule Path: "/shared" for a restricted user.

Filesystem contains: - /shared/ (intended to be accessible) - /shared_private/ (intended to be restricted)

User requests /shared_private/secret.txt: - strings.HasPrefix("/shared_private/secret.txt", "/shared") returns true - Allow rule applies - Access granted to the unintended directory

Impact

Authenticated users can access files in sibling directories that share a common prefix with an allowed directory, bypassing the admin's intended access configuration.

Prior art

Prior advisories GHSA-4mh3-h929-w968 (path-based access control bypass) and GHSA-9f3r-2vgw-m8xp (path traversal in copy/rename) addressed related access control issues. This HasPrefix prefix-collision is a distinct, unreported variant.

Suggested Fix

func (r *Rule) Matches(path string) bool {
    if r.Regex {
        return r.Regexp.MatchString(path)
    }
    prefix := r.Path
    if prefix != "/" && !strings.HasSuffix(prefix, "/") {
        prefix += "/"
    }
    return path == r.Path || strings.HasPrefix(path, prefix)
}

Koda Reef

Update: Fix submitted as PR #5889.

Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.63.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35605"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T00:04:49Z",
    "nvd_published_at": "2026-04-07T17:16:34Z",
    "severity": "MODERATE"
  },
  "details": "Hi,\n\nThe `Matches()` function in `rules/rules.go` uses `strings.HasPrefix()` without a trailing directory separator when matching paths against access rules. A rule for `/uploads` also matches `/uploads_backup/`, granting or denying access to unintended directories. Verified against v2.62.2 (commit 860c19d).\n\n## Details\n\nAt `rules/rules.go:29-35`:\n\n    func (r *Rule) Matches(path string) bool {\n        if r.Regex {\n            return r.Regexp.MatchString(path)\n        }\n        return strings.HasPrefix(path, r.Path)\n    }\n\nWhen a rule has `Path: \"/uploads\"`, any path starting with `/uploads` matches, including `/uploads_backup/secret.txt`. The regex variant at line 31 uses proper matching, but the non-regex path uses a prefix check without ensuring the match ends at a directory boundary.\n\nThe `Check()` function at `http/data.go:29-48` iterates all rules with last-match-wins semantics. No secondary validation exists beyond this prefix check.\n\n## PoC\n\nAdmin configures: allow rule `Path: \"/shared\"` for a restricted user.\n\nFilesystem contains:\n- `/shared/` (intended to be accessible)\n- `/shared_private/` (intended to be restricted)\n\nUser requests `/shared_private/secret.txt`:\n- `strings.HasPrefix(\"/shared_private/secret.txt\", \"/shared\")` returns true\n- Allow rule applies\n- Access granted to the unintended directory\n\n## Impact\n\nAuthenticated users can access files in sibling directories that share a common prefix with an allowed directory, bypassing the admin\u0027s intended access configuration.\n\n## Prior art\n\nPrior advisories GHSA-4mh3-h929-w968 (path-based access control bypass) and GHSA-9f3r-2vgw-m8xp (path traversal in copy/rename) addressed related access control issues. This HasPrefix prefix-collision is a distinct, unreported variant.\n\n## Suggested Fix\n\n    func (r *Rule) Matches(path string) bool {\n        if r.Regex {\n            return r.Regexp.MatchString(path)\n        }\n        prefix := r.Path\n        if prefix != \"/\" \u0026\u0026 !strings.HasSuffix(prefix, \"/\") {\n            prefix += \"/\"\n        }\n        return path == r.Path || strings.HasPrefix(path, prefix)\n    }\n\nKoda Reef\n\n---\n\n**Update:** Fix submitted as PR #5889.",
  "id": "GHSA-5q48-q4fm-g3m6",
  "modified": "2026-04-08T00:04:49Z",
  "published": "2026-04-08T00:04:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5q48-q4fm-g3m6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35605"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/pull/5889"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filebrowser/filebrowser"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "File Browser has an access rule bypass via HasPrefix without trailing separator in path matching"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.