CVE-2026-62684: File Browser Password Hash and Bypass Token Exposure Vulnerability

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

File Browser is an open-source file management application that allows users to share files and directories securely. It provides features such as password protection for shares, user management, and an intuitive web interface. However, a critical vulnerability has been identified that exposes sensitive information, including password hashes and bypass tokens, to authenticated users and administrators.

Vulnerability Detail

The vulnerability arises from the improper serialization of the Link struct in the File Browser application. When users create or list password-protected shares, the application returns the full bcrypt password hash and the bypass token in the JSON response. This exposure allows any authenticated user to access their own share secrets, while administrators can view the secrets of all users. The implications include offline cracking of share passwords and unauthorized access to protected shares using the bypass token.

go get github.com/filebrowser/filebrowser/v2@v2.63.23

go get github.com/filebrowser/filebrowser/v2@v2.63.17

Workaround

As a temporary workaround, avoid using password protection for shares until the package is updated. Additionally, you can modify the Link struct in the source code to prevent serialization of the password hash and token by changing the JSON tags as follows:

// share/share.go
type Link struct {
    Hash         string `json:"hash" storm:"id,index"`
    Path         string `json:"path" storm:"index"`
    UserID       uint   `json:"userID"`
    Expire       int64  `json:"expire"`
    PasswordHash string `json:"-" storm:"index"`   // never serialize
    Token        string `json:"-"`                 // never serialize in list responses
}

Conclusion

The File Browser vulnerability CVE-2026-62684 poses significant risks by exposing sensitive information through improper serialization. It is crucial for users to update to the patched version to safeguard their data and prevent unauthorized access. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.

See every vulnerability recorded for github.com/filebrowser/filebrowser/v2 →

FAQ