Detections
Analytics

SCA: security update for github.com/filebrowser/filebrowser/v2 (GHSA-5gg9-5g7w-hm73)

critical Tenable Cloud Security Plugin ID 438874

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files
 within a specified directory. In versions 2.61.2 and below, any unauthenticated visitor can register a
 full administrator account when self-registration (signup = true) is enabled and the default user
 permissions have perm.admin = true. The signup handler blindly applies all default settings (including
 Perm.Admin) to the new user without any server-side guard that strips admin from self-registered accounts.
 The signupHandler is supposed to create unprivileged accounts for new visitors. It contains no explicit
 user.Perm.Admin = false reset after applying defaults. If an administrator (intentionally or accidentally)
 configures defaults.perm.admin = true and also enables signup, every account created via the public
 registration endpoint is an administrator with full control over all files, users, and server settings.
 This issue has been resolved in version 2.62.0. (CVE-2026-32760)

Solution

Update the github.com/filebrowser/filebrowser/v2 library and its related packages to version 2.62.0 or later.

See Also

https://github.com/advisories/GHSA-5gg9-5g7w-hm73

Plugin Details

Severity: Critical

ID: 438874

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 3/17/2026

Updated: 7/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-32760

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 10

Threat Score: 10

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/16/2026

Vulnerability Publication Date: 3/16/2026

Reference Information

CVE: CVE-2026-32760