CVE-2026-61874CWE-863

filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete

Low · published July 12, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00315 · 23.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-12T12:06Z
EPSS history
Timeline
  • 12 JUL 12:06Z
    filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
    cvelistv5