CVE-2026-32758: 
NixOS vulnerability analysis and mitigation

CVE-2026-32758 is a path traversal and incorrect authorization vulnerability in File Browser (filebrowser/filebrowser) that allows authenticated users to bypass administrator-configured access deny rules when performing copy or rename operations. The flaw affects all versions up to and including 2.61.2 (Go module github.com/filebrowser/filebrowser/v2), and was patched in version 2.62.0. It was disclosed on March 14, 2026, via a GitHub Security Advisory and published to the NVD on March 20, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is a time-of-check/time-of-use (TOCTOU) path normalization flaw classified as CWE-22 (Path Traversal) and CWE-863 (Incorrect Authorization). In http/resource.go, the resourcePatchHandler retrieves the destination query parameter and URL-decodes it, then immediately passes the raw (uncleaned) value to the rules engine (rules/rules.go) for access control checks. The rules engine uses strings.HasPrefix for prefix matching or regexp.MatchString for regex matching against the literal, unnormalized path — so a destination like /public/../restricted/copied.txt does not match a deny rule for /restricted/. The actual file operation (fileutils.Copy or patchAction) subsequently calls path.Clean(), which resolves the .. sequences and writes the file to /restricted/copied.txt, bypassing the access control check entirely. A secondary issue exists where the error from url.QueryUnescape is checked after d.Check() runs, meaning the rules check may execute on a malformed string (GitHub Advisory, Security Advisory).

An authenticated user with Copy (Create) or Rename permissions can write or move files into any directory within the File Browser scope that is protected by administrator-configured deny rules, effectively nullifying those access controls. This results in a high integrity impact — arbitrary files can be placed in restricted directories — but there is no confidentiality impact (the GET handler uses cleaned paths, so restricted files cannot be read via this vector) and no availability impact. The vulnerability cannot be used to escape the user's BasePathFs scope enforced by afero, limiting the blast radius to within the configured file browser root (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-32758. The EPSS score is approximately 0.019% (0.000280), indicating a low near-term exploitation probability. The vulnerability requires authentication and at least Create or Rename permissions, raising the bar for exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this vulnerability (detection ID 761875) (GitHub Advisory, Feedly).

1. Authenticate: Obtain valid credentials for a File Browser account that has Copy (Create) or Rename permissions assigned.
2. Identify a restricted path: Determine a directory protected by an administrator-configured deny rule (e.g., /restricted/) by observing 403 responses when attempting direct copy operations to that path.
3. Craft a traversal payload: Construct a destination path that passes through an allowed directory using .. sequences to resolve to the restricted target — e.g., /public/../restricted/copied.txt (URL-encoded as %2Fpublic%2F..%2Frestricted%2Fcopied.txt).
4. Send the malicious PATCH request: Issue a PATCH request to the API with the traversal payload in the destination parameter:

   curl -X PATCH \
     -H "X-Auth: <token>" \
     "http://host/api/resources/public/test.txt?action=copy&destination=%2Fpublic%2F..%2Frestricted%2Fcopied.txt"

5. Verify bypass: The rules engine checks /public/../restricted/copied.txt (no match for /restricted/ prefix), allows the operation, and path.Clean() resolves the path to /restricted/copied.txt — the file is written to the restricted directory despite the deny rule (GitHub Advisory, Security Advisory).

• Network: HTTP PATCH requests to /api/resources/ endpoints containing URL-encoded .. sequences (e.g., %2F..%2F or /../) in the destination query parameter that would otherwise be blocked by access rules.
• Logs: File Browser access logs showing PATCH requests with destination values containing .. path components that resolve to directories covered by deny rules; successful 200 responses to such requests on versions ≤ 2.61.2.
• File System: Unexpected files appearing in directories protected by deny rules, particularly files whose names match files present in user-accessible directories, indicating unauthorized copy or rename operations.

Upgrade File Browser to version 2.62.0 or later, which applies the fix (commit 4bd7d69) that calls path.Clean() on both src and dst before the access rules check in resourcePatchHandler, ensuring the normalized path is evaluated (v2.62.0 Release, Fix Commit). There is no documented configuration-based workaround; upgrading is the only reliable remediation. As a defense-in-depth measure, administrators should restrict Copy and Rename permissions to only fully trusted users until the upgrade is applied.

The vulnerability was reported by researcher iconnnjka and remediated by File Browser maintainer hacdias, who published the advisory and patch on March 14, 2026. An openSUSE security announcement was issued referencing the vulnerability, and it was picked up by Linux security news aggregators. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (openSUSE Announce).