Description
File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| filebrowser | filebrowser | 2.63.6 – ≤ 2.63.23 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | filebrowser +1 | No fix yet | — |
References
- GitHub Security Advisory (GHSA-r6pg-pg54-rcr5) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion third-party-advisory