AIKIDO-2025-10423

github.com/filebrowser/filebrowser/v2 is vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere Pre-CVE

Low Risk

This Affects:

github.com/filebrowser/filebrowser/v2

2.0.0 - 2.33.10

Fixed in 2.34.0

TL;DR

Affected versions of this package expose the root directory path in the browser window title, allowing attackers to infer sensitive server structures. By observing customized directory names, such as /JohnDoeHome (in the window title), unauthenticated or low-privileged users can map user accounts, internal naming conventions, or project hierarchies. This type of information facilitates targeted attacks such as path traversal exploits by revealing restricted directory names.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

github.com/filebrowser/filebrowser/v2 is vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere in versions 2.0.0 - 2.33.10.