CVE-2026-62684

File Browser prior to 2.63.17 exposes the bcrypt password_hash and the bypass token of password-protected shares in API responses. The root cause is that the Link storage struct is serialized directly via unfiltered json.Marshal in sharePostHandler, shareListHandler, and shareGetsHandler, so both...

CVE-2026-62684

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST...