Vulnerability Description
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/filebrowser/filebrowser/commit/be23ab3a15bf957928ecfed88de5ab
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-pp88-jhwj-5q
- https://www.vulncheck.com/advisories/filebrowser-before-stale-public-share-via-t
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-pp88-jhwj-5q
FAQ
What is CVE-2026-61874?
CVE-2026-61874 is a vulnerability with a CVSS score of 3.1 (LOW). filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can del...
How severe is CVE-2026-61874?
CVE-2026-61874 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-61874?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.