trace_b299cf48411f4550854c21ba15adeb6b

findercompleted96excellent

StartedApr 13, 2026, 5:23 PM

EndedApr 13, 2026, 5:26 PM

Casecase_1ff68966277c45e89eaaf7adfeec08c6

Modelmoonshotai/kimi-k2.5

Context

Blind label

blind_4e049e701cb0

Advisory

GHSA-v9w4-gm2x-6rvf • File Browser share links remain accessible after Share/Download permissions are revoked

Judge score

96 (excellent)

Rubric breakdown

Target Alignment

9.8

Source To Sink Reasoning

9.6

Impact And Exploitability

9.2

Evidence Quality

9.4

Overclaim Control

9.1

Prompt451 chars

Start from http/public.go, especially the public share access wrapper identified in the advisory, and compare it with the permission guard in http/share.go. This source file has a known vulnerability sink in it. Traverse the codebase and report the vulnerability. You can report multiple vulnerabilities. Ground the report in the exact request path, the user/share lookup flow, and the missing permission re-validation before serving public downloads.

OutputJSON

{
  "executiveSummary": "This report identifies a high-severity authorization bypass vulnerability in File Browser's public share access mechanism. The issue is that public share links remain functional even after the owner's Share and Download permissions are revoked. The root cause is a missing permission re-validation step in the `withHashFile` wrapper (`http/public.go`), which contrasts with the proper permission guard on share creation (`withPermShare` in `http/share.go`). Any user who once had valid sharing permissions can maintain indefinite access through existing share links, bypassing administrative revocation of their privileges.",
  "reports": [
    {
      "title": "Missing Permission Re-validation in Public Share Download Access",
      "severity": "HIGH",
      "summary": "The public share download handler (`/api/public/dl/` and `/api/public/share/`) fails to re-validate the share owner's current `Share` and `Download` permissions before serving files. When a share is created, the `withPermShare` guard in `http/share.go` correctly enforces `d.user.Perm.Share && d.user.Perm.Download`. However, when accessing a public share, the `withHashFile` wrapper in `http/public.go` loads the user from the database but never checks their current permissions. This allows previously-created share links to remain accessible even after the owner's Share or Download permissions are revoked by an administrator.",
      "rootCauseAnalysis": "The vulnerability stems from inconsistent permission checking between share creation and share access. In `http/share.go`, the `withPermShare` middleware (lines 17-23) correctly enforces: `if !d.user.Perm.Share || !d.user.Perm.Download { return http.StatusForbidden, nil }`. However, in `http/public.go`, the `withHashFile` wrapper (lines 25-84) loads the link owner via `d.store.Users.Get(d.server.Root, link.UserID)` but immediately proceeds to serve the content without checking `user.Perm.Share` or `user.Perm.Download`. This creates a trust-on-first-use (TOFU) permission model that violates the principle of continuous authorization.",
      "impact": "An attacker who initially had valid permissions but later had them revoked (due to policy violations, compromise, or role changes) can continue accessing sensitive files through previously-created share links. This bypasses administrative controls and can lead to unauthorized data exfiltration even after permissions are explicitly revoked. This is particularly critical in scenarios where: (1) compromised accounts have their sharing privileges revoked, (2) departing employees lose access, or (3) temporary access privileges expire.",
      "attackPath": "1. Attacker creates a user account with Share and Download permissions\n2. Attacker creates a public share link to a sensitive file\n3. Administrator discovers the abuse and revokes the attacker's Share and/or Download permissions\n4. The public share link continues to work because `withHashFile` does not re-validate per

Tool calls

(16)

$find /workspace -type f -name "*.go" | head -20

/workspace/auth/auth.go
/workspace/auth/hook.go
/workspace/auth/json.go
/workspace/auth/none.go
/workspace/auth/proxy.go
/workspace/auth/storage.go
/workspace/cmd/cmd.go
/workspace/cmd/cmd_test.go
/workspace/cmd/cmds.go
/workspace/cmd/cmds_add.go
/workspace/cmd/cmds_ls.go
/workspace/cmd/cmds_rm.go

$ls -la /workspace/http/

total 24
drwxr-xr-x 1 user user     0 Jan  1 00:00 .
drwxr-xr-x 1 user user     0 Jan  1 00:00 ..
-rw-r--r-- 1 user user  7152 Apr 10 18:34 auth.go
-rw-r--r-- 1 user user  2598 Apr 10 18:34 commands.go
-rw-r--r-- 1 user user  1909 Apr 10 18:34 data.go
-rw-r--r-- 1 user user   177 Apr 10 18:34 headers.go
-rw-r--r-- 1 user user  4246 Apr 10 18:34 http.go
-rw-r--r-- 1 user user  4012 Apr 10 18:34 preview.go
-rw-r--r-- 1 user user  2153 Apr 10 18:34 preview_enum.go
-rw-r--r-- 1 user user  3749 Apr 10 18:34 public.go
-rw-r--r-- 1 user user  4410 Apr 10 18:34 public_test.go

$cat /workspace/http/public.go

package fbhttp

import (
	"errors"
	"net/http"
	"net/url"
	"path"
	"path/filepath"
	"strings"

	"github.com/spf13/afero"
	"golang.org/x/crypto/bcrypt"

$cat /workspace/http/share.go

package fbhttp

import (
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"sort"
	"strconv"
	"strings"

$cat /workspace/http/http.go

package fbhttp

import (
	"io/fs"
	"net/http"

	"github.com/gorilla/mux"

	"github.com/filebrowser/filebrowser/v2/settings"
	"github.com/filebrowser/filebrowser/v2/storage"
)

$cat /workspace/cmd/cmds.go

package cmd

import (
	"fmt"

	"github.com/spf13/cobra"
)

func init() {
	rootCmd.AddCommand(cmdsCmd)
}

$find /workspace -name "*.go" -exec rg -l "type Perm struct" {} \;exit 124

(no output)

$rg -n "Perm\s+struct" /workspaceexit 124

(no output)

$find /workspace -type f -name "*.go" | xargs grep -l "type Permissions" 2>/dev/null

/workspace/users/permissions.go

$cat /workspace/users/permissions.go

package users

// Permissions describe a user's permissions.
type Permissions struct {
	Admin    bool `json:"admin"`
	Execute  bool `json:"execute"`
	Create   bool `json:"create"`
	Rename   bool `json:"rename"`
	Modify   bool `json:"modify"`
	Delete   bool `json:"delete"`
	Share    bool `json:"share"`
	Download bool `json:"download"`

$cat /workspace/users/users.go

package users

import (
	"path/filepath"

	"github.com/spf13/afero"

	fberrors "github.com/filebrowser/filebrowser/v2/errors"
	"github.com/filebrowser/filebrowser/v2/files"
	"github.com/filebrowser/filebrowser/v2/rules"
)

$cat /workspace/share/share.go

package share

type CreateBody struct {
	Password string `json:"password"`
	Expires  string `json:"expires"`
	Unit     string `json:"unit"`
}

// Link is the information needed to build a shareable link.
type Link struct {
	Hash         string `json:"hash" storm:"id,index"`
	Path         string `json:"path" storm:"index"`

$cat /workspace/http/public_test.go

package fbhttp

import (
	"fmt"
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"testing"

	"github.com/asdine/storm/v3"
	"github.com/spf13/afero"

$cat /workspace/http/auth.go

package fbhttp

import (
	"encoding/json"
	"errors"
	"log"
	"net/http"
	"os"
	"strings"
	"time"

	"github.com/golang-jwt/jwt/v5"

$find /workspace -name "storage.go" -type f

/workspace/auth/storage.go
/workspace/settings/storage.go
/workspace/share/storage.go
/workspace/storage/storage.go
/workspace/users/storage.go

$cat /workspace/storage/storage.go

package storage

import (
	"github.com/filebrowser/filebrowser/v2/auth"
	"github.com/filebrowser/filebrowser/v2/settings"
	"github.com/filebrowser/filebrowser/v2/share"
	"github.com/filebrowser/filebrowser/v2/users"
)

// Storage is a storage powered by a Backend which makes the necessary
// verifications when fetching and saving data to ensure consistency.
type Storage struct {

Step spans

(17)