CVE-2026-28492: 
NixOS vulnerability analysis and mitigation

CVE-2026-28492 is a path traversal vulnerability in File Browser's public share link feature that allows authenticated users to browse and download files from sibling directories outside the intended shared directory. It affects all File Browser v2.x versions up to and including 2.60.0, and was disclosed on February 28, 2026, with a patch released in version 2.61.0. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat).

The root cause is an incorrect path computation in the withHashFile middleware in http/public.go (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). When a shared link targets a directory, the code erroneously calls filepath.Dir(link.Path) to compute the BasePathFs root — for example, a share of /documents/shared results in a filesystem root of /documents (the parent), rather than the intended /documents/shared. This misconfigured afero.NewBasePathFs root exposes all sibling directories and files under the parent to anyone holding the share link, affecting both the directory listing endpoint (/api/public/share/{hash}) and the file download endpoint (/api/public/dl/{hash}/path). The fix replaces filepath.Dir(basePath) with filepath.Clean(link.Path) to correctly anchor the filesystem root to the shared directory itself (GitHub Advisory, Patch Commit).

Exploitation allows unauthenticated actors (or those with only a share link) to enumerate and download any file within the parent directory of the shared folder, including files in sibling directories that were never intended to be shared. This results in a high confidentiality impact — sensitive files such as credentials, private documents, or configuration files stored alongside shared directories can be fully exfiltrated. Integrity and availability are not directly affected, but the data exposure risk is significant for any deployment where multiple users or data categories coexist under a common parent directory (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, providing concrete HTTP request sequences to reproduce the vulnerability against a real File Browser deployment without requiring custom code (GitHub Advisory). The EPSS score is 0.04% (low probability of near-term exploitation), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of this report. The vulnerability requires only low privileges (ability to create a public share link) and no user interaction, making it straightforward to exploit once a share link is obtained. Qualys has added detection for this CVE (detection ID 761789) (Feedly).

1. Reconnaissance: Identify a File Browser instance running version 2.60.0 or earlier. Obtain or be granted a public share link for any directory (e.g., /documents/shared), either by having a low-privileged account or by receiving a shared link from another user.
2. Enumerate parent directory: Send a GET request to the share listing endpoint: GET /api/public/share/{hash}. Instead of listing only /documents/shared/, the response will reveal the contents of the parent directory /documents/, including all sibling directories such as secrets/ and private/.
3. Identify target files: Review the directory listing response to identify sensitive files in sibling directories (e.g., /documents/secrets/passwords.txt, /documents/private/financial.csv).
4. Download sibling files: Send a GET request to the download endpoint with the sibling file path: GET /api/public/dl/{hash}/secrets/passwords.txt. The server returns HTTP 200 with the file contents, despite the file being outside the intended share scope.
5. Exfiltrate data: Repeat step 4 for any additional files of interest within the parent directory scope (GitHub Advisory).

• Network: Unusual GET requests to /api/public/share/{hash} that return directory listings containing directories other than the intended shared directory; GET requests to /api/public/dl/{hash}/<sibling-path> for paths outside the shared directory.
• Logs: Web server or application access logs showing requests to /api/public/dl/{hash}/ with path components referencing directories not under the shared path (e.g., ../secrets/, sibling directory names); repeated access to the same share hash from external or unexpected IP addresses.
• File System: No direct file system artifacts from exploitation, as the attack is read-only; however, audit logs may show unexpected file reads on sensitive files in directories adjacent to shared directories (GitHub Advisory).

Upgrade File Browser to version 2.61.0 or later, which corrects the path computation in withHashFile by replacing filepath.Dir(basePath) with filepath.Clean(link.Path) (Patch Commit, Release v2.61.0). As a temporary workaround prior to patching, restrict the ability to create public share links to highly trusted users only, and ensure that sensitive files are not stored in directories that are siblings of any shared directory. Avoid placing confidential data under the same parent directory as any publicly shared folder until the patch is applied (GitHub Advisory).

The vulnerability was reported by researcher uug4na and remediated by File Browser maintainer hacdias, who published the advisory and patch on February 28, 2026 (GitHub Advisory). Red Hat tracked the CVE and published their own advisory entry (Red Hat). openSUSE also issued a security announcement referencing the vulnerability (openSUSE). Community coverage was noted on security aggregators including VulnDB and CVEFeed, and a technical write-up was published by Infinit Security (Infinit Security).