CVE-2026-35605 File Browser has an access rule bypass via HasPrefix without trailing separator in path matching

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the Matches function in rules/rules.go uses strings.HasPrefix without a trailing directory separator when matching paths against access rules. ...

CVE-2026-35605

creationtimestamp| type| source ---|---|--- 2026-04-04 20:31:18+00:00| published-proof-of-concept| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5q48-q4fm-g3m6 2026-04-09 17:22:32+00:00| published-proof-of-concept| Telegram/vilnQ64f45V0K93eyMbGXUSRwitUexdwMg6sdyLUCQzylsw...