Go/github.com/filebrowser/filebrowser/v2 CVE-2026-35606: high 7.5, EPSS 0.34%

File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check

Action: Upgrade github.com/filebrowser/filebrowser/v2 to 2.63.1 or later.

go get github.com/filebrowser/filebrowser/v2@v2.63.1

Affected

Fixed versions

Sources

• osv: GHSA-67cg-cpj7-qgc9
• nvd: CVE-2026-35606
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-67cg-cpj7-qgc9
• https://github.com/filebrowser/filebrowser

CVE-2026-35606 · published 2026-04-08T00:05:09Z · modified 2026-06-25T18:56:18.366755805Z · JSON