Vulnerability Description
filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by path, so it survives the rename and remains dormant (returning 404 while the path is empty). When any new, unrelated file later appears at the original shared path — via re-upload, another user with create permission, or a hook — the stale public share link serves that new file under the original link's password and expiry settings, unexpectedly exposing it.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m8v4-4w34-rr
- https://www.vulncheck.com/advisories/filebrowser-through-2.63.23-stale-share-lin
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m8v4-4w34-rr
FAQ
What is CVE-2026-82237?
CVE-2026-82237 is a vulnerability with a CVSS score of 3.1 (LOW). filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by path, so it survives the rename and remains...
How severe is CVE-2026-82237?
CVE-2026-82237 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82237?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.