CVE-2026-32758

The record

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.2 and below are vulnerable to Path Traversal through the resourcePatchHandler (http/resource.go). The destination path in resourcePatchHandler is validated against access rules before being cleaned/normalized, while the actual file operation calls path.Clean() afterward—resolving .. sequences into a different effective path. This allows an authenticated user with Create or Rename permissions to bypass administrator-configured deny rules (both prefix-based and regex-based) by injecting .. sequences in the destination parameter of a PATCH request. As a result, the user can write or move files into any deny-rule-protected path within their scope. However, this cannot be used to escape the user's BasePathFs scope or read from restricted paths. This issue has been fixed in version 2.62.0.

Affected packages

Related vulnerabilities

• CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
• CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
• CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
• CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
• CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb
• CVE-2026-33997 Moby is an open source container framework. Also affects govulncheck-vulndb
• CVE-2026-27018 Gotenberg is an API for converting document formats. Also affects govulncheck-vulndb
• CVE-2026-33026 Nginx UI is a web user interface for the Nginx web server. Also affects govulncheck-vulndb