File Browser <=2.63.5 Incorrect Access Control in Public Directory Shares via Path Rebase Bypass (CVE-2025-54091)

Vulnerability Overview Title: Incorrect access control in public directory shares via rule path rebasing Description: The File Browser public sharing handler rebases the sharer's filesystem root within the shared directory, then evaluates descendant paths against the sharer's global and per-user rules. Because the rebased path is relative to the sharer's original scope rather than the original path, an attacker can access and list files and subdirectories that the sharer explicitly blocked. Severity: 7.5 / 10 CVE ID: CVE-2025-54091 Affected Versions Affected Versions: <= 2.63.5 Fixed Version: 2.63.6 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None Solution Fixed Version: 2.63.6 POC Code Core Vulnerability Code Path Impact This vulnerability allows recipients of public shares to read and browse files and directories that the sharer explicitly intended to block via File Browser rules. Since the vulnerable code path is part of the public sharing functionality, exposure can be unauthenticated and internet-accessible, provided the share link is made public. In real-world deployments, this could lead to the leakage of sensitive information, configuration files, backup materials, private project directories, or any other content that administrators or users attempted to hide under the shared parent directory using the built-in rules system.

Goal Reached Thanks to every supporter — we hit 100%!

File Browser <=2.63.5 Incorrect Access Control in Public Directory Shares via Path Rebase Bypass (CVE-2025-54091)

More from this source