CVE-2026-35606

OVERVIEW CVE-2026-35606 is a permission bypass vulnerability affecting File Browser versions prior to 2.63.1. The resourceGetHandler in the application fails to validate the Perm.Download permission flag before serving text file content, allowing unauthorized users to read any text files within their accessible scope. While three other content-serving endpoints properly enforce download restrictions, this inconsistency in the resource handler creates an exploitable security gap. SEVERITY This vulnerability carries a CVSS v3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity and results in high confidentiality impact, as attackers can access sensitive file contents without authorization. The FAUCET risk score of 48.0/100 indicates moderate concern relative to similar vulnerabilities. No integrity or availability impacts are present, limiting the scope of potential damage to information disclosure. EXPLOITATION STATUS The vulnerability is actively listed on the KEV Catalog Hot List, indicating increased monitoring and community attention. However, the EPSS score of 0.00037 suggests current exploitation probability is very low. No public exploit code appears to be widely available, though the straightforward nature of the permission bypass makes this a potentially easy vulnerability to exploit once discovered by threat actors. Organizations should prioritize patching to version 2.63.1 before this vulnerability gains broader attention.