CVE-2026-62684— File Browser: Share API exposes the password hash and bypass token
Quick assessment
Affected
filebrowser filebrowser
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
File Browser 是一个文件管理界面，用于在指定目录内上传、删除、预览、重命名和编辑文件。在版本 2.63.17 之前， 存储结构会通过 方法，在 、 和 中被直接序列化。这导致 和 接口暴露了 和绕过令牌（bypass token）。攻击者（包括管理员）可以获取每个用户分享中的这些密钥信息，从而能够进行离线密码破解，或直接访问受保护的共享链接。该问题已在版本 2.63.17 中得到修复。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| filebrowser | filebrowser | < 2.63.17 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-62684
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
File Browser: Share API exposes the password hash and bypass token
Source: CVE Program / CVE List V5
Vulnerability Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST /api/share/{path} and GET /api/shares to expose password_hash and the bypass token, while an administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares. This issue is fixed in version 2.63.17.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| filebrowser | filebrowser | < 2.63.17 | - |
|
II. Public POCs for CVE-2026-62684
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62684
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-62684 (1)
Vendor Advisories for CVE-2026-62684 (1)
Vendor Pages for CVE-2026-62684 (1)
-
🔗 Release v2.63.17 · filebrowser/filebrowser · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: filebrowser
-
CVE-2026-72838
FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload -
CVE-2026-72837
File Browser before 2.63.20 Privilege Escalation via Proxy A -
CVE-2026-72835
filebrowser before v2.63.21 Access Rule Bypass via Path Cano -
CVE-2026-72836
FileBrowser before 2.63.19 Case Sensitivity Authentication B -
CVE-2026-72834
filebrowser before 2.63.19 Permission Bypass via checksum
Same vendor: filebrowser
-
CVE-2026-72838
FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload -
CVE-2026-72837
File Browser before 2.63.20 Privilege Escalation via Proxy A -
CVE-2026-72836
FileBrowser before 2.63.19 Case Sensitivity Authentication B -
CVE-2026-72835
filebrowser before v2.63.21 Access Rule Bypass via Path Cano -
CVE-2026-72834
filebrowser before 2.63.19 Permission Bypass via checksum
Same weakness: CWE-200
-
CVE-2026-75099
Apache Allura: Unauthenticated REST disclosure -
CVE-2026-13343
Uninitialised stack memory disclosure in the MIDI 2.0 UMP St -
CVE-2026-78386
Unauthenticated Disclosure of Scraping Credentials and Bypas -
CVE-2026-78378
Redis Glob Pattern Injection Allows Unauthorized Enumeration -
CVE-2026-59256
WWBN AVideo Unbound Token Authorization Bypass via Gallery
V. Comments for CVE-2026-62684
No comments yet