CVE-2026-35604: 
NixOS vulnerability analysis and mitigation

CVE-2026-35604 is an incorrect authorization vulnerability in File Browser, a web-based file management interface, that allows unauthenticated users to access share links even after the share owner's permissions have been revoked by an administrator. The vulnerability affects all versions of github.com/filebrowser/filebrowser/v2 prior to 2.63.1 (confirmed against v2.62.2, commit 860c19d). It was published on April 4, 2026, by researcher kodareef5 via GitHub Security Advisory GHSA-v9w4-gm2x-6rvf, and assigned CVE-2026-35604 on April 7, 2026. The CVSS v3.1 base score is 8.1 (High) and the CVSS v4.0 base score is 8.2 (High) (Github Advisory).

The root cause is CWE-863 (Incorrect Authorization): the public share download handler (withHashFile in http/public.go) verifies that the share link and associated user exist, but does not re-validate whether the share owner still holds the required Share and Download permissions at access time. In contrast, the share creation handler (withPermShare in http/share.go) correctly enforces these permissions. This means that once a share link is created, it persists as a valid, unauthenticated access path regardless of subsequent permission revocations by an admin. The attack requires no authentication and only requires possession of a previously issued share link hash, which may have been distributed to external parties (Github Advisory, Fix PR).

Successful exploitation allows any unauthenticated user with knowledge of a share link to download files from the File Browser instance, even after an administrator has explicitly revoked the share owner's permissions. This creates a false sense of security for administrators who believe that revoking permissions terminates all active sharing. The confidentiality impact is high, as sensitive files within the shared scope remain exposed; integrity and availability are not directly impacted by this vulnerability. The vulnerability is classified in the same class as the previously disclosed GHSA-68j5-4m99-w9w9 (Github Advisory).

A complete, runtime-verified proof-of-concept (PoC) using curl commands is publicly available in the GitHub Security Advisory, demonstrating the full exploit flow against v2.62.2. The EPSS score is approximately 0.069% (21st percentile), indicating a low but non-zero probability of exploitation in the wild within 30 days. There is no current evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Reconnaissance: Identify a publicly accessible File Browser instance running a version prior to 2.63.1. Instances are often self-hosted and may be discoverable via Shodan or Censys by searching for the File Browser web interface.
2. Obtain a share link: Acquire a previously distributed share link hash (e.g., from email, chat, or public postings). The hash is the short token appended to the public download URL (e.g., fB4Qwtsn).
3. Attempt unauthenticated access: Send an unauthenticated HTTP GET request to the public download endpoint using the known hash:

   curl http://<target>:<port>/api/public/dl/<hash>

4. Receive file content: If the share owner's permissions have been revoked but the instance is unpatched, the server returns the file content with HTTP 200 OK, bypassing the intended access control.
5. Iterate over known hashes: If multiple share links were previously distributed, repeat step 3 for each known hash to enumerate accessible files (Github Advisory).

• Network: Unauthenticated HTTP GET requests to /api/public/dl/<hash> endpoints returning HTTP 200 from IP addresses not associated with legitimate share recipients; unusual volume of requests to public download endpoints.
• Logs: File Browser access logs showing successful (200 OK) responses to /api/public/dl/ paths from external or unexpected IP addresses, particularly after a user's permissions were administratively revoked.
• Application State: Active share links in the database associated with users whose share and download permissions are set to false; discrepancy between user permission state and existing share link records.

Upgrade File Browser to version 2.63.1 or later, which adds permission re-validation in the withHashFile handler to check the share owner's current Share and Download permissions before serving any public share request (Github Advisory, Fix PR). As an immediate workaround prior to patching, administrators should manually delete or expire all existing share links created by users whose permissions have been revoked, as simply revoking permissions does not invalidate pre-existing links. Periodic audits of active share links against current user permission states are recommended as an ongoing operational control.

The vulnerability was responsibly disclosed by researcher kodareef5, who also submitted the fix as PR #5888, which was promptly reviewed and merged by maintainer hacdias on April 4, 2026 — the same day as disclosure. The NixOS security tracker (NixOS/nixpkgs#507904) flagged the issue for packaging updates shortly after disclosure. No significant broader media coverage or notable social media discussion has been identified beyond standard CVE tracking feeds (Github Advisory, Fix PR).