Executive brief
File Browser is a web-based interface used for managing and sharing files within a directory. A security flaw allows users to create public sharing links for files that do not yet exist. If a sensitive file is later created at that specific location, it will be automatically and publicly accessible via the pre-created link, potentially leading to the unauthorized exposure of private data.
Technical details
An improper authorization vulnerability exists in File Browser's share management component. The `POST /api/share/<path>` endpoint fails to verify the existence of a file before generating and storing a public share record. Because shares are bound to a path string rather than a specific file object, a share created for a non-existent path becomes valid as soon as a file is uploaded to that location. An attacker with sharing permissions can pre-emptively 'squat' on paths to intercept future files. This issue is resolved in version 2.63.7 by implementing an existence check before committing share records.
Affected products
- filebrowser filebrowser < 2.63.7
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: NVD publication date
- 2026-06-25: patched: Fix released in version 2.63.7