CVE-2026-54089: File Browser: Authentication Bypass via Proxy Auth Header Forgery

Synopsis

Authentication bypass in File Browser (filebrowser/filebrowser versions 2.0.0-rc.1 and later) allows any unauthenticated attacker who can reach the server over the network to impersonate any user, including administrators, by forging a single HTTP header. No credentials are needed. Successful exploitation gives the attacker full read and write access to all files managed by the instance, and a secondary primitive lets the attacker create arbitrary new user accounts with no authorization. HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send an HTTP request directly to the File Browser server over the network; any internet-exposed or internally reachable instance is in scope.

• AuthenticationNot required

  No credentials of any kind are needed; the attacker forges a single HTTP header value to impersonate any account, including admin.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link, open a file, or take any action for exploitation to succeed.

• Attack complexityDetail

  The exploit is reliable and condition-free: sending one crafted HTTP header is sufficient with no race conditions or environment-specific prerequisites.

Blast Radius

• Reads, downloads, or exfiltrates any file accessible through the File Browser instance, including all files in the configured managed directory.
• Uploads, modifies, deletes, or overwrites files in the managed directory, enabling persistent tampering or destruction of stored data.
• Creates arbitrary new user accounts with no authorization, establishing persistent footholds that survive a password reset on the original admin account.
• Gains full administrative control of the File Browser instance by impersonating the admin user, including changing configuration and managing existing user accounts.