Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0984

NIXPKGS-2026-0984
published on
updated 3 weeks, 4 days ago by @LeSuisse Activity log
  • Created suggestion
  • @LeSuisse ignored
    4 packages
    • filebrowser-quantum
    • python312Packages.filebrowser-safe
    • python313Packages.filebrowser-safe
    • python314Packages.filebrowser-safe
  • @LeSuisse accepted
  • @LeSuisse published on GitHub
File Browser share links remain accessible after Share/Download permissions are revoked

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner's current permissions. This vulnerability is fixed in 2.63.1.

Affected products

filebrowser
  • ==< 2.63.1

Matching in nixpkgs

Ignored packages (4)

Package maintainers