File Browser Path Traversal Vulnerability in Public Share Links Allowing Unauthorized File Access

A path traversal vulnerability has been identified in File Browser versions through 2.60.0. When a user creates a public share link for a directory, the 'withHashFile' middleware incorrectly sets the filesystem root to the parent directory of the shared directory. This flaw allows anyone with the share link to browse and download files from all sibling directories, rather than just the intended shared directory.

Impact

This vulnerability leads to unauthorized access and disclosure of files from sibling directories outside the shared directory scope.

Reproduction

To reproduce this vulnerability, create a public share link for a directory containing files. The share link will grant access to all files in the parent directory, including those in sibling directories, bypassing intended access controls.

Remediation

Users can update to File Browser version 2.61.0 or later, where this vulnerability has been patched.