CVE-2026-61874
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in FileBrowser before version 2.63.17 fails to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.
Risk Assessment
An attacker can recreate the same directory after deletion, and the stale public share link will expose the new content, leading to unauthorized data access.
Recommendation
Update FileBrowser to version 2.63.17 or later immediately, which normalizes paths before share index operations.
Original NVD description (English source)
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.