CVE-2026-62684
Received Received - Intake

File Browser Information Disclosure via API Endpoints

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST /api/share/{path} and GET /api/shares to expose password_hash and the bypass token, while an administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares. This issue is fixed in version 2.63.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-62684
EUVD
EUVD-2026-60961

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
filebrowser filebrowser to 2.63.16 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

File Browser versions before 2.63.17 have an issue where sensitive data like password hashes and bypass tokens are exposed through API endpoints. The Link storage struct is directly serialized in responses from POST /api/share/{path} and GET /api/shares, allowing unauthorized access to these secrets.

Detection Guidance

Check File Browser version with: curl -s http://localhost:8080/api/health | grep version. If version is below 2.63.17, the system is vulnerable. Inspect API responses for /api/share/{path} and /api/shares for exposed password_hash and bypass token fields.

Impact Analysis

An attacker with access to these API responses could retrieve password hashes and bypass tokens for all users' shares. This enables offline password cracking attempts and direct access to protected shares, compromising data confidentiality and integrity.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection such as GDPR and HIPAA due to unauthorized exposure of sensitive user data. It could lead to data breaches, unauthorized access, and failure to maintain confidentiality of protected information.

Mitigation Strategies

Upgrade File Browser to version 2.63.17 or later immediately. Review and rotate all user share passwords and bypass tokens. Restrict access to sensitive API endpoints and monitor for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62684. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart