Go/github.com/filebrowser/filebrowser/v2 CVE-2026-54091: unknown, EPSS 0.52%

File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser

Action: Upgrade github.com/filebrowser/filebrowser/v2 to 2.63.6 or later.

go get github.com/filebrowser/filebrowser/v2@v2.63.6

Affected

Fixed versions

Sources

• osv: GO-2026-5458#Go/github.com/filebrowser/filebrowser/v2
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-j9jx-hp4c-ghhh
• https://github.com/filebrowser/filebrowser/commit/e07c59df0b850f5924d5b1683e8609661ddcf534
• https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6

CVE-2026-54091 · published 2026-06-25T22:34:31Z · modified 2026-06-25T23:01:13.643954606Z · JSON