Filebrowser Path Traversal via Path Canonicalization Bypass

Executive Summary

This vulnerability affects filebrowser versions before v2.63.21. It allows authenticated users to bypass administrator-defined deny rules by using case-variant paths (e.g., 'FILE.TXT' vs 'file.txt') or backslash-separated paths on Windows. The system fails to canonicalize paths before checking access rules, so alternate representations that don't match any rule can still resolve to the same file, granting unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

Check your filebrowser version with 'filebrowser version' or 'filebrowser -v'. If it is below 2.63.21, the system is vulnerable. Inspect access logs for unusual path patterns like mixed case or backslashes in requests to denied paths.

Useful 0 Not Useful 0

Impact Analysis

If you use filebrowser versions before 2.63.21, an attacker with authenticated access could bypass restrictions and access files that administrators explicitly denied. This could lead to unauthorized data exposure or modification within your permitted scope. The impact depends on your filebrowser configuration and the sensitivity of the files involved.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data protection, such as GDPR (data confidentiality) or HIPAA (protected health information access). Unauthorized access to sensitive files may result in regulatory penalties, data breaches, or loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade filebrowser to version 2.63.21 or later immediately. There are no workarounds other than upgrading. Review and update access rules after upgrading to ensure proper enforcement.

Useful 0 Not Useful 0