Skip to content
OpenAdvisories
Low · 3.1 CVE-2026-61874 EUVD-2026-43234GHSA-7cj6-cw3p-4jpw

filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete

Published Jul 12, 2026 · Updated Jul 14, 2026 · Assigned by VulnCheck

Description

filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.

Affected products

VendorProductAffectedFixed
filebrowser filebrowser < 2.63.17 2.63.17

References