CVE-2026-54096: File Browser improper authorization via pre-created public shares

CVE-2026-54096 · Severity: high · CVSS 8.4 · Published 2026-06-25

File Browser is a web-based interface used for managing and sharing files within a directory. A security flaw allows users to create public sharing links for files that do not yet exist. If a sensitive file is later created at that specific location, it will be automatically and publicly accessible via the pre-created link, potentially leading to the unauthorized exposure of private data.

Technologies: File Browser, github.com/filebrowser/filebrowser (Go), github.com/filebrowser/filebrowser/v2 (Go). Vendors: File Browser, Go.

Quick answers

Is CVE-2026-54096 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54096 being exploited in the wild.
How severe is CVE-2026-54096?
High severity, with a CVSS score of 8.4, published 25 June 2026.
Which products and versions are affected?
File Browser < 2.63.7, <= 2.63.6; github.com/filebrowser/filebrowser (Go) <= 1.11.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.11.0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.6, SEMVER:introduced=0,fixed=2.63.7.
Is there a fix for CVE-2026-54096?
Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54096 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54096?
Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.7 or later
    go get github.com/filebrowser/filebrowser/v2@v2.63.7

Technical details

An improper authorization vulnerability exists in File Browser's share management component. The `POST /api/share/<path>` endpoint fails to verify the existence of a file before generating and storing a public share record. Because shares are bound to a path string rather than a specific file object, a share created for a non-existent path becomes valid as soon as a file is uploaded to that location. An attacker with sharing permissions can pre-emptively 'squat' on paths to intercept future files. This issue is resolved in version 2.63.7 by implementing an existence check before committing share records.

Affected products

  • filebrowser filebrowser < 2.63.7

Identifiers

  • CVE-2026-54096
  • GHSA-3q2p-72cj-682c
  • GO-2026-5096

Timeline

  • 2026-06-04: advisory: GitHub Security Advisory published
  • 2026-06-25: disclosed: NVD publication date
  • 2026-06-25: patched: Fix released in version 2.63.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.