https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:45:22 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-62684 <p>File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST /api/share/{path} and GET /api/shares to expose password_hash and the bypass token, while an administrator can retrieve these secrets for every user&#39;s shares, enabling offline password cracking and direct access to protected shares. This issue is fixed in version 2.63.17.</p> <p>File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST /api/share/{path} and GET /api/shares to expose password_hash and the bypass token, while an administrator can retrieve these secrets for every user&#39;s shares, enabling offline password cracking and direct access to protected shares. This issue is fixed in version 2.63.17.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-62684 https://vulnerability.circl.lu/vuln/ghsa-833g-cqhp-h72j <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2</p> <p>## Summary</p> <p>When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt `password_hash` and the secret `token` of the share. The `Link` storage struct is serialized directly with `json.Marshal` and tags `password_hash` and `token` for output, with no field filtering. Any authenticated user receives these secrets for their own shares, and an administrator listing all shares via `GET /api/shares` receives the password hash and bypass token for **every** user&#39;s shares, enabling offline cracking of share passwords and direct password-bypass access to protected shares.</p> <p>## Details</p> <p>**1. The `Link` struct serializes both secrets to JSON (`share/share.go:10-19`)**</p> <p>```go type Link struct { Hash string `json:&#34;hash&#34; storm:&#34;id,index&#34;` Path string `json:&#34;path&#34; storm:&#34;index&#34;` UserID uint `json:&#34;userID&#34;` Expire int64 `json:&#34;expire&#34;` PasswordHash string `json:&#34;password_hash,omitempty&#34;` // line 15, bcrypt hash exposed // Token is only set when PasswordHash is set; it bypasses the password. Token string `json:&#34;token,omitempty&#34;` // line 19, bypass token exposed } ```</p> <p>`omitempty` means the hash and token are emitted whenever a share is password-protected, i.e. in every response for such a share.</p> <p>**2. The share handlers return the full struct through unfiltered `json.Marshal`**</p> <p>`sharePostHandler` returns the created `Link` with `renderJSON(w, r, s)` (`http/s…</p> <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2</p> <p>## Summary</p> <p>When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt `password_hash` and the secret `token` of the share. The `Link` storage struct is serialized directly with `json.Marshal` and tags `password_hash` and `token` for output, with no field filtering. Any authenticated user receives these secrets for their own shares, and an administrator listing all shares via `GET /api/shares` receives the password hash and bypass token for **every** user&#39;s shares, enabling offline cracking of share passwords and direct password-bypass access to protected shares.</p> <p>## Details</p> <p>**1. The `Link` struct serializes both secrets to JSON (`share/share.go:10-19`)**</p> <p>```go type Link struct { Hash string `json:&#34;hash&#34; storm:&#34;id,index&#34;` Path string `json:&#34;path&#34; storm:&#34;index&#34;` UserID uint `json:&#34;userID&#34;` Expire int64 `json:&#34;expire&#34;` PasswordHash string `json:&#34;password_hash,omitempty&#34;` // line 15, bcrypt hash exposed // Token is only set when PasswordHash is set; it bypasses the password. Token string `json:&#34;token,omitempty&#34;` // line 19, bypass token exposed } ```</p> <p>`omitempty` means the hash and token are emitted whenever a share is password-protected, i.e. in every response for such a share.</p> <p>**2. The share handlers return the full struct through unfiltered `json.Marshal`**</p> <p>`sharePostHandler` returns the created `Link` with `renderJSON(w, r, s)` (`http/s…</p> https://vulnerability.circl.lu/vuln/ghsa-833g-cqhp-h72j