CVE-2026-35606: 
NixOS vulnerability analysis and mitigation

CVE-2026-35606 is a missing authorization vulnerability in File Browser, an open-source web-based file management interface, that allows authenticated users with download permissions explicitly disabled to read the full content of any text file within their authorized scope. The flaw exists in versions up to and including 2.62.2 (confirmed on commit 860c19d) and was disclosed on April 4, 2026, with a patch released in version 2.63.1. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, Security Advisory).

The root cause is CWE-862 (Missing Authorization): the resourceGetHandler function in http/resource.go hardcodes Content: true in the FileOptions struct, unconditionally loading text file content without checking the Perm.Download permission flag. This is inconsistent with the three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle), all of which correctly return HTTP 202 when Perm.Download is false. Two bypass paths exist: (1) sending a request to /api/resources/<file> with the X-Encoding: true header, which returns raw file bytes as application/octet-stream; and (2) requesting /api/resources/<file> without the header and extracting the .content field from the JSON response. The bypass is limited to text files up to the 10MB detectType limit and does not circumvent path-level authorization (Security Advisory).

Successful exploitation allows an authenticated user whose download permission has been explicitly revoked to read the full plaintext content of any text file within their authorized directory scope, including source code, configuration files, credentials, and API tokens. There is no impact on integrity or availability, and the vulnerability does not enable path traversal beyond the user's authorized scope. However, exposure of credentials or API tokens stored in text files could facilitate lateral movement or privilege escalation in downstream systems (Github Advisory, Security Advisory).

A public proof-of-concept is available in the official GitHub Security Advisory, consisting of concrete curl commands that demonstrate both bypass paths against a live File Browser instance. No evidence of in-the-wild exploitation has been confirmed as of the time of this report. The EPSS score is approximately 0.038–0.043% (13th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Security Advisory, Github Advisory).

1. Identify target: Locate a File Browser instance running version ≤ 2.62.2 that is accessible over the network.
2. Obtain credentials: Acquire valid credentials for a user account that has download: false set (or any account, as the attacker may be the restricted user themselves).
3. Authenticate: Log in to obtain an authentication token:

   TOKEN=$(curl -s http://HOST/api/login -d '{"username":"restricted","password":"testuser123456"}')

4. Bypass 1 — X-Encoding header: Send a GET request to /api/resources/<filename> with the X-Encoding: true header to receive raw file bytes:

   curl -s http://HOST/api/resources/secret.txt -H "X-Auth: $TOKEN" -H "X-Encoding: true"
   # Returns: SECRET_PASSWORD=hunter2

5. Bypass 2 — JSON content field: Send a GET request to /api/resources/<filename> without the encoding header and extract the .content field from the JSON response:

   curl -s http://HOST/api/resources/secret.txt -H "X-Auth: $TOKEN" | jq .content
   # Returns: "SECRET_PASSWORD=hunter2\n"

6. Exfiltrate sensitive data: Enumerate and read text files (source code, config files, .env files, credential stores) within the user's authorized scope to harvest secrets for further exploitation (Security Advisory).

• Network: Unusual or repeated HTTP GET requests to /api/resources/<filename> endpoints, particularly with the X-Encoding: true header, from accounts that should not be downloading files; responses with Content-Type: application/octet-stream from the /api/resources/ path.
• Logs: File Browser access logs showing 200 OK responses to /api/resources/ for users with download: false permissions; requests to /api/resources/ with X-Encoding: true headers returning file content rather than metadata.
• Behavioral: A restricted user account (with download disabled) making repeated requests to /api/resources/ for sensitive text files such as .env, config.yaml, credentials.txt, or similar; absence of corresponding 202 responses that would indicate proper enforcement.

The vendor has released File Browser version 2.63.1, which fixes the vulnerability by conditionally setting Content: d.user.Perm.Download in FileOptions and adding an explicit Perm.Download guard before the X-Encoding raw byte path in http/resource.go. Administrators should upgrade to version 2.63.1 or later immediately. As a temporary workaround until patching is complete, restrict network access to File Browser instances to trusted networks only, and audit user permission configurations to minimize the number of accounts with access to sensitive text files (Security Advisory, Github Advisory).

The vulnerability was reported by security researcher kodareef5 and published by File Browser maintainer hacdias on April 4, 2026. The fix was submitted as PR #5891 to the File Browser repository. No significant broader media coverage or notable external researcher commentary beyond the official advisory has been identified at this time (Security Advisory).