CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad



CVE-2026-54089

CVE-2026-54089: Authentication Bypass by Spoofing in File Browser

Amit Schendel
Amit Schendel
Senior Security Researcher

Jul 11, 2026·7 min read·32 visits

Executive Summary (TL;DR)

Unauthenticated network-adjacent or remote attackers can gain full administrative access to File Browser instances by forging identity headers when the service is exposed without a validating reverse proxy.

CVE-2026-54089 is a critical authentication bypass vulnerability in File Browser affecting instances configured with proxy-based authentication. An unauthenticated remote attacker with direct network access can impersonate arbitrary users or register new accounts by spoofing configured HTTP headers.

Vulnerability Overview

File Browser is an open-source web-based file management interface designed to provide users with a platform to upload, delete, preview, rename, and edit files within a specified directory. To accommodate various organizational integration patterns, File Browser supports multiple authentication methods, including JSON web tokens, external command execution, and proxy-based authentication. When proxy-based authentication (auth.method=proxy) is configured, File Browser delegates identity verification to an upstream reverse proxy.

Under this architecture, the upstream proxy authenticates the user and forwards the authenticated identity to File Browser via a specified HTTP header, such as X-Forwarded-User or Remote-User. However, File Browser lacks any built-in mechanism to verify the origin or integrity of these incoming HTTP requests. It does not validate that the request originated from a trusted source IP address, nor does it require any cryptographic verification such as a shared HMAC signature.

Consequently, if an attacker can establish direct network connectivity to the File Browser application port, bypassing the reverse proxy entirely, the application will implicitly trust any client-supplied HTTP headers. This structural trust boundary failure allows unauthenticated remote attackers to impersonate arbitrary users, including the system administrator, by injecting the configured authentication header. The primary weakness is classified under CWE-290 (Authentication Bypass by Spoofing) and CWE-287 (Improper Authentication).

Root Cause Analysis

The root cause of CVE-2026-54089 lies within the implementation of the ProxyAuth.Auth method inside the auth/proxy.go source file. This method is invoked during the login handling phase when the application authentication method is set to "proxy". The design relies entirely on the presence of a pre-configured HTTP header key to determine user identity and issue access tokens.

When a request reaches the authentication handler, the application extracts the username directly from the HTTP request headers using the r.Header.Get method. The extracted string is then immediately queried against the underlying BoltDB user store using usr.Get. No verification is performed to check whether the request passed through an authorized gateway, meaning any direct TCP connection to the service port can supply this header and successfully authenticate.

Furthermore, the application exhibits an automatic account registration behavior if the supplied username does not exist in the database. When the query returns fberrors.ErrNotExist, the authentication handler catches this error and calls the internal createUser function. This helper generates a random password, hashes it, instantiates a new user object with default non-admin permissions, and persists it to the database before logging the user in. This behavioral path provides an unauthorized account creation primitive to any network-adjacent or remote attacker.

Code Analysis

The authentication logic within File Browser illustrates the implementation gap between trust establishment and enforcement. In auth/proxy.go, the Auth function retrieves the configured header without validation:

// Auth authenticates the user via an HTTP header.
func (a ProxyAuth) Auth(r *http.Request, usr users.Store, setting *settings.Settings, srv *settings.Server) (*users.User, error) {
	// Extract username directly from HTTP header without origin check
	username := r.Header.Get(a.Header)
	user, err := usr.Get(srv.Root, srv.FollowExternalSymlinks, username)
	if errors.Is(err, fberrors.ErrNotExist) {
		// Automatically provision new user account if username is unknown
		return a.createUser(usr, setting, srv, username)
	}
	return user, err
}

In the HTTP routing layer located in http/auth.go, the handler loginHandler invokes this method when processing POST requests to /api/login:

func loginHandler(tokenExpireTime time.Duration) handleFunc {
	return func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
		// ... [Body parsing and limit checks] ...
		auther, err := d.store.Auth.Get(d.settings.AuthMethod)
		if err != nil {
			return http.StatusInternalServerError, err
		}
 
		// Executes the vulnerable Auth method
		user, err := auther.Auth(r, d.store.Users, d.settings, d.server)
		switch {
		case errors.Is(err, os.ErrPermission):
			return http.StatusForbidden, nil
		case err != nil {
			return http.StatusInternalServerError, err
		}
 
		// Generates and returns a signed JWT token for the authenticated user
		return printToken(w, r, d, user, tokenExpireTime)
	}
}

Because there is no architectural fix provided in the codebase—the vulnerability being categorized as a structural design limitation—remediation must be accomplished via deployment configuration rather than a code patch. The lack of checking for source origins or pre-shared keys means the code continues to trust incoming HTTP metadata implicitly. Security relies entirely on the host configuration preventing direct external communication with the bound port.

Exploitation Methodology

Exploitation of CVE-2026-54089 requires three conditions: the target File Browser instance must have proxy authentication enabled, the attacker must know or guess the configured proxy header name, and the application port must be exposed directly to the attacker's network segment.

An attacker can construct a simple request to the login endpoint. If the default header X-Forwarded-User is used, the attack sequence is illustrated in the diagram below:

Following the token generation, the attacker copies the JWT from the HTTP response body and presents it in the X-Auth header of subsequent requests. This grants complete administrative control over the filesystem directories exposed by File Browser, enabling arbitrary file upload, download, modification, and deletion. If the attacker targets a non-existent username instead, the database creates a new account, giving the attacker a persistent entry point with default user permissions.

Impact Assessment

The security impact of CVE-2026-54089 is severe, leading to a complete compromise of confidentiality and integrity for all files managed by the affected application instance. Because the application processes files directly on the host system or within a container environment, an administrative takeover allows attackers to read, write, or destroy sensitive application data, configuration files, and system backups.

Under CVSS v3.1, this vulnerability is rated at 9.1 (Critical), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The attack complexity is low since it requires no specialized tools or prior credentials. There is no user interaction required, and the attack can be executed entirely over the network.

While availability impact is rated as 'None' under the CVSS vector because File Browser itself does not crash or experience a denial of service directly due to the authentication bypass, the integrity impact allows an attacker to delete or encrypt files, which effectively causes a high-severity operational impact. No active, wild exploitation has been cataloged by CISA, and there is currently no public automated exploit tool, keeping the EPSS score low.

Remediation and Mitigation

Because CVE-2026-54089 is an inherent design behavior of the proxy authentication feature rather than a programming oversight, no code patch is available. Remediation must be achieved through proper network design and server hardening.

The primary mitigation strategy is network isolation. Administrators must ensure that the File Browser process binds only to localhost (127.0.0.1 or ::1) or resides within an isolated private container network. The application must not be exposed directly to any public or untrusted network interfaces.

Additionally, the upstream reverse proxy must be configured to strip any incoming client-supplied authentication headers. For example, in an Nginx deployment, the proxy configuration must explicitly overwrite the header using values populated by the proxy's own authentication mechanisms, such as $remote_user from auth_basic. This ensures that malicious clients cannot inject arbitrary usernames through HTTP header spoofing. If these network security controls cannot be implemented, administrators must disable proxy authentication entirely and revert to standard database-backed form authentication using the command filebrowser config set --auth.method=json.

Technical Appendix

CVSS Score
9.1/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Probability
0.34%
Top 74% most exploited

Affected Systems

File Browser deployments configured with proxy authentication (auth.method=proxy) that are directly exposed to untrusted networks

Affected Versions Detail

Product
Affected Versions
Fixed Version
File Browser
File Browser
>= 2.0.0-rc.1None
AttributeDetail
CWE IDCWE-290
Attack VectorNetwork
CVSS v3.19.1 (Critical)
EPSS Score0.00337
Exploit StatusNone
KEV StatusNot listed

MITRE ATT&CK Mapping

T1078Valid Accounts
Initial Access
T1190Exploit Public-Facing Application
Initial Access
CWE-290
Authentication Bypass by Spoofing

The application fails to authenticate or verify the source of claims asserted in HTTP headers, leading to unauthorized identity spoofing.

References & Sources

  • [1]GitHub Security Advisory GHSA-xqp3-jq6g-x3qm
  • [2]File Browser Proxy Authentication Code
  • [3]File Browser Authentication Endpoint Code
  • [4]NVD CVE-2026-54089 Details

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•40 minutes ago•GHSA-FX4F-MHW4-QM7J
7.5

GHSA-FX4F-MHW4-QM7J: Integer Overflow and Denial of Service in vibeio-http Chunked Parser

An integer overflow vulnerability exists in the HTTP/1.x chunked encoding parser of the vibeio-http library. The flaw is caused by unchecked integer addition when calculating the total buffer size required for processing parsed chunk lengths. By sending a maliciously crafted HTTP request containing an extremely large chunk size, an unauthenticated remote attacker can trigger a runtime panic, leading to complete denial of service.

Amit Schendel
Amit Schendel
1 views•6 min read
•about 13 hours ago•GHSA-4PH6-MJV7-3FQ6
6.5

GHSA-4PH6-MJV7-3FQ6: Improper Handling of Untrusted DNS-over-HTTPS Response Data in netfoil

netfoil, an allowlist-based DNS proxy, failed to sanitize ALPN fields parsed from untrusted DNS-over-HTTPS (DoH) HTTPS Resource Records. This allowed attackers to inject ANSI escape sequences into log files or trigger Denial of Service (DoS) via uncontrolled memory allocations.

Alon Barad
Alon Barad
6 views•6 min read
•about 14 hours ago•GHSA-3GJW-F78C-VVPW
7.5

GHSA-3GJW-F78C-VVPW: Denial of Service via Unhandled Out-of-Bounds Indexing Panic in tokio-postgres

An issue was discovered in the tokio-postgres library for Rust prior to version 0.7.18. A trust assumption mismatch between the PostgreSQL protocol messages sent by a server and how they are parsed and indexed by the client-side library allows a rogue or compromised database server to trigger a Denial of Service (DoS) crash via an unhandled out-of-bounds slice indexing panic.

Alon Barad
Alon Barad
6 views•6 min read
•1 day ago•CVE-2026-14669
8.8

CVE-2026-14669: PostgreSQL to_char() Timezone Abbreviation Heap-Based Buffer Overflow

CVE-2026-14669 is a critical heap-based buffer overflow vulnerability in PostgreSQL's date/time formatting function to_char(timestamptz). The flaw arises from unsafe copying of user-controlled timezone abbreviations into a fixed-size internal buffer. An authenticated database user can trigger this issue by setting a long POSIX timezone abbreviation containing custom formatting, allowing them to overwrite adjacent heap structures and hijack execution control to achieve remote code execution (RCE) with the privileges of the 'postgres' operating system user.

Alon Barad
Alon Barad
17 views•6 min read
•3 days ago•CVE-2026-63462
7.5

CVE-2026-63462: Unauthenticated Stack Overflow Denial of Service in Unleash Server

An unauthenticated remote denial of service vulnerability exists in the Unleash feature management platform. By submitting a crafted JSON payload containing deeply nested structures to an OpenAPI-validated endpoint, an attacker can trigger uncontrolled recursion within the error formatting module. This leads to a call-stack exhaustion (RangeError: Maximum call stack size exceeded) inside the Node.js runtime, causing the service to crash immediately without recovery.

Alon Barad
Alon Barad
12 views•6 min read
•3 days ago•CVE-2026-63004
5.5

CVE-2026-63004: Server-Side Request Forgery in Unleash Addon and Integration Subsystem

CVE-2026-63004 is a server-side request forgery (SSRF) vulnerability in the Unleash feature management platform. Authenticated administrators with CREATE_ADDON or UPDATE_ADDON privileges can exploit this vulnerability to initiate requests to loopback addresses, private networks, and cloud metadata endpoints, potentially leading to information disclosure and credential extraction.

Amit Schendel
Amit Schendel
10 views•8 min read