CVE-2026-35605: File Browser has an access rule bypass via HasPrefix without trailing separator in path matching

April 8, 2026

Hi,

The Matches() function in rules/rules.go uses strings.HasPrefix() without a trailing directory separator when matching paths against access rules. A rule for /uploads also matches /uploads_backup/, granting or denying access to unintended directories. Verified against v2.62.2 (commit 860c19d).

References

github.com/advisories/GHSA-5q48-q4fm-g3m6
github.com/filebrowser/filebrowser
github.com/filebrowser/filebrowser/pull/5889
github.com/filebrowser/filebrowser/security/advisories/GHSA-5q48-q4fm-g3m6
nvd.nist.gov/vuln/detail/CVE-2026-35605

Code Behaviors & Features

Detect and mitigate CVE-2026-35605 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →