File Browser's password protection of links is bypassable
Date: 2025-06
Affected: go/github.com/filebrowser/filebrowser/v2, go/github.com/filebrowser/filebrowser
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2025-52996
CWE: CWE-305
CVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

## Summary ## Files managed by the *File Browser* can be shared with a link to external persons. While the application allows protecting those links with a password, the implementation is error-prone, making an incidental unprotected sharing of a file possible. ## Impact ## File owners might rest in the assumption that their shared files are only accessible to persons knowing the defined password, giving them a false sense of security. Meanwhile, attackers gaining access to the unprotected link can use this information alone to download the possibly sensitive file. ## Vulnerability Description ## When sharing a file, the user is presented with a dialog asking for an optional password to protect the file share. The assumption of the user at this point would be, that the shared file won't be accessible without knowledge of the password. After clicking on `SHARE` the following dialog opens allowing the file's owner to copy the share-link: ![image](https://github.com/user-attachments/assets/f3add074-40ac-4367-a538-ede5bb526916) In fact, there is not one, but two links offered: A `Download Link` and an unnamed second one. They have the following format: * http://filebrowser.local:8080/share/6Gtw0xAw * http://filebrowser.local:8080/api/public/dl/6Gtw0xAw/dummy1.pdf?token=voDK6j[...] Apparently, the first of the two share links is that one that users are supposed to actually share, while the second one is a direct download link not protected by the password. This behavior i


Mitigations:

Architectural layers (MAESTRO):