CVE-2026-61874

filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete

State: Published
Severity: 2.3 Low
Published: Jul 12, 2026
Updated: Jul 14, 2026
Reserved: Jul 10, 2026

Description

filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
filebrowserfilebrowser	before 2.63.17Affected 2.63.17Not affected

References

GitHub Security Advisory (GHSA-pp88-jhwj-5qh5)vendor-advisory
https://github.com/filebrowser/filebrowser/commit/be23ab3a15bf957928ecfed88de5ab67850c1b9cpatch
VulnCheck Advisory: filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Deletethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.