CVE-2026-35604

EUVD-2026-19776
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner's current permissions. This vulnerability is fixed in 2.63.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 21%
Affected Products (NVD)
VendorProductVersion
filebrowserfilebrowser
𝑥
< 2.63.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/filebrowser/filebrowser/pull/5888
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-v9w4-gm2x-6rvf