Executive Summary

CVE-2026-48777 is a critical path traversal vulnerability in the FileBrowser application affecting versions prior to 1.3.3-stable and 1.4.2-beta. The issue exists in the public share PATCH handler, where user-controlled file paths (fromPath and toPath) are joined with a trusted shared directory path before any sanitization occurs. Because the filepath.Join function collapses path segments like ".." before the sanitizer runs, attackers can manipulate these paths to escape the intended shared directory.

This allows anyone holding a public share link with AllowModify=true to move, copy, or rename arbitrary files within the share owner's source root directory, potentially accessing or tampering with files outside the shared directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access and modification of files outside the intended shared directory. An attacker can move, copy, or rename files arbitrarily within the share owner's source root, potentially exposing sensitive data or overwriting important files.

Because the attack requires no privileges or user interaction and can be executed remotely, it poses a high risk to confidentiality and integrity of data managed by the FileBrowser instance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade FileBrowser to a fixed version where the issue has been resolved.

• Upgrade to version 1.3.3-stable or later.
• Alternatively, upgrade to version 1.4.2-beta or later.

These versions include fixes that properly sanitize user-provided paths before joining them with the share directory path, preventing path traversal attacks.

Additionally, review and restrict public share links with AllowModify=true to trusted users only, as possession of such links enables exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to perform unauthorized file operations outside the intended shared directory, potentially exposing or tampering with sensitive files within the share owner's source root directory.

Such unauthorized access and modification of files could lead to violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls over access to sensitive personal or health information.

Because the flaw enables remote, unauthenticated attackers to move, copy, or rename arbitrary files, it undermines confidentiality and integrity controls mandated by these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized or suspicious PATCH requests to the public share endpoint that include path traversal patterns in the fromPath or toPath fields.

Specifically, look for HTTP PATCH requests to the public share handler containing payloads with path segments like "../" which attempt to move, copy, or rename files outside the intended shared directory.

Example commands to detect such activity could include using network traffic inspection tools or web server logs to filter for suspicious PATCH requests.

• Using tcpdump or tshark to capture HTTP PATCH requests: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i PATCH
• Using grep on web server access logs to find PATCH requests with path traversal attempts: grep -i PATCH /var/log/filebrowser/access.log | grep '\.\./'
• Using curl or similar tools to test if the server is vulnerable by crafting a PATCH request with fromPath or toPath containing '../' sequences on a public share link with AllowModify=true.

Note that detection requires access to logs or network traffic where such PATCH requests can be observed, and knowledge of public share links with modification permissions.

Useful 0 Not Useful 0