Listen to this Post
How the CVE Works
The vulnerability occurs when File Browser generates two share links for password-protected filesβone requiring authentication and another unprotected direct download link. The unprotected link contains an access token (token=voDK6j[...]) in the URL, bypassing password checks. Attackers can exploit this by:
1. Intercepting the unprotected link via browser history, proxy logs, or accidental sharing.
2. Using the token to directly access files via `/api/public/dl/6Gtw0xAw?inline=true&token=voDK6j[…]` without a password.
The server fails to validate the password for token-based requests, leaking sensitive files.
DailyCVE Form
Platform: File Browser
Version: 2.32.0
Vulnerability: Insecure direct download
Severity: Critical
Date: 2025-06-29
Prediction: Patch by 2025-07-15
What Undercode Say
Analytics:
curl -X GET "http://filebrowser.local:8080/api/public/dl/6Gtw0xAw?token=voDK6j[...]" grep "X-SHARE-PASSWORD" /var/log/filebrowser/access.log
Exploit:
1. Extract tokens from proxy logs.
2. Craft direct download requests.
Protection:
- Disable unprotected links in GUI.
- Enforce password checks for all `/api/public/dl` requests.
Impact:
- Unauthorized file access.
- Data exfiltration.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
