FileRun exposure needs share roles and app-password review

FileRun is a self-hosted file manager that supports browser access, sync clients, WebDAV, mobile apps, and external shares. Its security model is therefore distributed across user accounts, roles, share links, app passwords, and the web server path that exposes the storage.

On 9 November 2026 at 08:50 Asia/Shanghai, a ZoomEye query using sub_type=all, page 1, and page size 1 returned 3,987 assets for title="FileRun" && http.body="FileRun". The title query returned 4,060, the body query returned 121,174, and the application fingerprint returned zero. The body count is too broad to use as a product inventory, so the title-and-body intersection is the conservative figure.

The query is reproducible through the selected ZoomEye search.

Roles and visitors are different principals

FileRun's documentation describes predefined roles for viewers, commenters, editors, contributors, distributors, content managers, and uploaders. External shares can assign a role to visitors. The same label does not necessarily mean the same authority in every context.

The documentation says guest accounts cannot sync, use the API, or share files. Those restrictions matter when a user who can view a link is mistaken for a full FileRun account. A share link is a tokenized path with its own role. It should not become a way to enumerate the file tree or reuse a stronger account's API.

Review the share's audience, password, expiration, download permission, and role. Test a link as an unauthenticated visitor and as a signed-in user. If a file is shared through two paths, confirm that revoking one link does not leave the other active.

App passwords separate clients from the login password

FileRun's documentation says that since version 2026.3.0 an account cannot use its own username and password for WebDAV, the API, desktop sync, or mobile apps. Those connections use a generated app password. This is a useful separation because a compromised client credential can be revoked without changing the account password.

Inventory app passwords by device or application. Record creation time and last use where the UI exposes it. Remove credentials for lost devices and retired integrations. Do not let a support process generate a new app password and send it through an unencrypted channel.

Test what an app password can reach. A sync credential may expose the user's home folder and shared folders. A read-only role should not gain write access merely because the client uses a different protocol. Test WebDAV and the web UI against the same object.

The web server path matters

FileRun stores user home folders on the server filesystem. The administrator guide warns that files uploaded to those folders should not be directly accessible through the website's public path. A reverse proxy or web server document root that exposes the storage directory bypasses FileRun's roles and share checks.

Confirm that the storage path is outside the public document root, that directory listing is disabled, and that the application's data directory is not served as static content. Test with a known private file from an unauthenticated network position.

Review SSO and two-factor configuration. FileRun supports OpenID Connect and TOTP according to its security page. The superuser recovery path is useful, but it must be protected separately. A local superuser that can bypass SSO is a high-value account and should have strong credentials and controlled access.

A practical review for an owned instance

Sign in as a normal user and list the accessible home and shared folders. Create a link with the narrowest role, open it without a session, and test download and edit behavior. Generate an app password, use it through WebDAV, and revoke it. Then test the same path again.

Ask the web server owner to show the document root and the storage path. If a public URL can reach a file in the storage directory, the application authorization layer is not the only boundary. Correct the web server configuration before tuning application roles.

The 3,987 matches are a title-and-body inventory, not a count of public file trees. For each owned host, compare roles, guest restrictions, app passwords, SSO, and the web server path. FileRun provides many useful controls. The review is effective only when the same file is tested through every access method.

References

• FileRun documentation, Administrator's guide
• FileRun documentation, User's guide
• FileRun documentation, Two-factor authentication
• FileRun security, Security features