CVE-2026-82236CWE-459

CVE-2026-82236

Low · published August 28, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
27.5
In the wild
Unconfirmed
What it is

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00351 · 27.5th percentile
Weakness
CWE-459 · Incomplete Cleanup
Published
2026-08-28T16:16Z
References (4)
https://github.com/filebrowser/filebrowser/commit/0231b7eb · [email protected]https://github.com/filebrowser/filebrowser/security/advisories/GHSA-r6pg-pg54-rcr5 · [email protected]https://www.vulncheck.com/advisories/file-browser-2.63.6-through-2.63.23-share-link-exposure-via-file-deletion · [email protected]https://github.com/filebrowser/filebrowser/security/advisories/GHSA-r6pg-pg54-rcr5 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 10:49Z
    File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion
    cvelistv5