File Browser is retiring after its developers said they were no longer able to maintain its security or keep up with incoming vulnerabilities. This tag covers a series of write-ups on publicly disclosed File Browser CVEs, tracing each vulnerability from the original report back into the source code to understand where and why it exists in the simplest way possible.
The issue is CVE-2026-25889: Authentication Bypass in User Password Update, but when you look at the source code, it almost feels like someone deliberately went out of their way to make the code vulnerable. Of course, that’s not actually what happened. if d.settings.AuthMethod == auth.MethodJSONAuth { var sensibleFields = map[string]struct{}{ "all": {}, "username": {}, "password": {}, "scope": {}, "lockPassword": {}, "commands": {}, "perm": {}, } for _, field := range req.Which { if _, ok := sensibleFields[field]; ok { if !users.CheckPwd(req.CurrentPassword, d.user.Password) { return http.StatusBadRequest, fberrors.ErrCurrentPasswordIncorrect } break } } } So, there’s a map called sensibleFields, and on each request, the Which field is checked to see whether it contains any of the listed values, such as username or password. If it does, the handler requires the current password. ...
For this blog, we’ll look at CVE-2026-34530: Stored Cross-Site Scripting via text/template branding injection and trace it back to the source code to understand exactly where and why the vulnerability exists. We have two keyword in the title: Stored Cross-Site Scripting text/template branding injection The blog assumes you at least have a basic understanding of Cross-Site Scripting. You may learn more about it at What is cross-site scripting (XSS)? We’ll come down to the second keyword: text/template branding injection ...
For this blog, we’ll look at CVE-2026-73613: Out-of-scope file deletion via symlink-following delete in TUS upload-cache eviction and trace it back to the source code to understand exactly where the vulnerable behavior comes from and how it can lead to file deletion outside the intended directory. We have 3 keywords in the title: Out-of-scope file deletion symlink TUS upload-cache eviction 1. Out-of-scope file deletion This one is pretty simple. Consider the following scenario: ...