Version 2.61.0 and earlier of File Browser allow a permission enforcement bypass that gives users who lack explicit download rights but have share rights the ability to obtain file contents. The interface creates a public share URL and the download handler serves the file without re‑checking download permissions, allowing authenticated users to circumvent restrictions. This undermines data‑loss prevention and role segregation, exposing sensitive files to unauthorized access.

File Browser, versions 2.61.0 and below are vulnerable. The issue was catalogued under the filebrowser:filebrowser product line. No other vendor or product variants are listed as affected.

The CVSS score of 6.5 classifies the vulnerability as moderate severity; EPSS indicates an exceptionally low probability of exploitation (<1 %). The attack vector requires authentication and possession of share privileges, meaning only authorized users can exploit the flaw. Since the exploit does not rely on untrusted input or privilege escalation, the scope is limited to file data exfiltration rather than full system compromise. The lack of a CISA KEV listing further reflects the relatively low exploit likelihood.