CyberRota Analysis
AI-GeneratedFilebrowser versions up to 2.63.16 are vulnerable due to improper scope and permission restrictions when self-signup is enabled with the default CreateUserDir setting. This flaw allows unauthenticated attackers to create accounts that gain full access to the server's root directory, enabling them to create, modify, delete, rename, share, and download any files. Organizations using this software, particularly those with self-signup features enabled, should prioritize immediate remediation to prevent unauthorized access and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions, allowing unrestricted access to all files.