A critical authorization bypass vulnerability in File Browser enables authenticated attackers to access restricted filesystem paths, potentially leading to full data compromise.

The application fails to properly validate file path rules when multiple slashes are included in the request URL. This allows an authenticated user to bypass configured "Disallow" restrictions and access files outside of permitted directories.

The vulnerability carries a CVSS score of 8.1, reflecting a high risk to data confidentiality and integrity. Successful exploitation grants an attacker unauthorized access to sensitive system files or restricted user data, which could lead to significant data breaches, intellectual property theft, or further system compromise.

Immediate Action: Update File Browser to version 2.57.1 or later to resolve the path resolution flaw.

Proactive Monitoring: Review web server and application access logs for suspicious URL patterns, specifically those containing repeated forward slashes (e.g., //private/) directed at sensitive endpoints.

Compensating Controls: Implement strict network-level access controls and ensure that the File Browser service runs with the least privilege necessary to limit the scope of potential unauthorized file access.

Public Exploit Available: Unknown

Given the high CVSS score and the ability for authenticated users to circumvent security boundaries, organizations should prioritize patching File Browser immediately. Administrators must ensure that all instances are updated to version 2.57.1 to prevent unauthorized access to sensitive filesystem resources.