CVE-2026-54096

Summary

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, POST /api/share/<path> accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created public share immediately becomes valid and exposes the new file through GET /api/public/dl/<hash>. This vulnerability is fixed in 2.63.7.

Affected Software

Weaknesses

• CWE-863: CWE-863: Incorrect Authorization

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

Additional References

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2p-72cj-682c

References

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2p-72cj-682c

• ←Previous
• Next→