CVE-2026-61874

EUVD-2026-43234
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
3.1 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
filebrowserfilebrowser
𝑥
< 2.63.17
CNA
Common Weakness Enumeration
References
https://github.com/filebrowser/filebrowser/commit/be23ab3a15bf957928ecfed88de5ab67850c1b9c
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-pp88-jhwj-5qh5
https://www.vulncheck.com/advisories/filebrowser-before-stale-public-share-via-trailing-slash-delete