Executive brief
File Browser is a web-based file manager used to browse and manage server files remotely. When configured with proxy authentication and a custom logout page, the application fails to validate JWT token expiration, allowing attackers who previously obtained a valid token to indefinitely access protected files and administrative settings—including reading sensitive data and renewing their access without re-authentication.
Technical details
The vulnerability is an authentication bypass due to improper JWT expiration validation in the http/auth.go middleware. When proxy authentication is enabled with a non-default logout page, the renewableErr function treats expired JWTs as renewable without verifying that the proxy still asserts the same identity. An attacker with a previously valid (but now expired) token can send requests to protected routes and administrative endpoints; the withUser middleware loads the expired claims and continues, and the renewHandler endpoint issues fresh tokens. The flaw affects versions 2.50.0 through 2.63.21 and requires the attacker to possess a token issued before expiration; no proxy bypass or token forgery is necessary. The vulnerability was patched in v2.63.22 by adding a check that the proxy header identity matches the token claims before waiving expiration.
Affected products
- File Browser File Browser 2.50.0 through 2.63.21
Timeline
- 2026-07-27: disclosed: Fix commit published (72faf6d)
- 2026-07-27: patched: Patched in v2.63.22
- 2026-08-13: advisory: CVE-2026-73611 published