CyberRota Analysis
AI-GeneratedFile Browser versions prior to 2.63.20 are vulnerable due to improper handling of user directory isolation during proxy and hook authentication auto-provisioning, allowing authenticated attackers to access, modify, delete, and share files from other users. The impact is significant, as it compromises user data confidentiality and integrity. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.