# CVE-2026-54096: File Browser improper authorization via pre-created public shares

Source: https://junglewise.ai/threats/cve-2026-54096-file-browser-improper-authorization-via-pre-created-public-shares  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-54096 · Severity: high · CVSS 8.4 · Published 2026-06-25

File Browser is a web-based interface used for managing and sharing files within a directory. A security flaw allows users to create public sharing links for files that do not yet exist. If a sensitive file is later created at that specific location, it will be automatically and publicly accessible via the pre-created link, potentially leading to the unauthorized exposure of private data.

Technologies: [File Browser](https://junglewise.ai/threats/technologies/file-browser), [github.com/filebrowser/filebrowser (Go)](https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser), [github.com/filebrowser/filebrowser/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser-v2). Vendors: [File Browser](https://junglewise.ai/threats/vendors/file-browser), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-54096 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54096 being exploited in the wild.

**How severe is CVE-2026-54096?** High severity, with a CVSS score of 8.4, published 25 June 2026.

**Which products and versions are affected?** File Browser < 2.63.7, <= 2.63.6; github.com/filebrowser/filebrowser (Go) <= 1.11.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.11.0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.6, SEMVER:introduced=0,fixed=2.63.7.

**Is there a fix for CVE-2026-54096?** Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54096 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54096?** Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.7 or later

  ```sh
  go get github.com/filebrowser/filebrowser/v2@v2.63.7
  ```


## Technical details

An improper authorization vulnerability exists in File Browser's share management component. The `POST /api/share/<path>` endpoint fails to verify the existence of a file before generating and storing a public share record. Because shares are bound to a path string rather than a specific file object, a share created for a non-existent path becomes valid as soon as a file is uploaded to that location. An attacker with sharing permissions can pre-emptively 'squat' on paths to intercept future files. This issue is resolved in version 2.63.7 by implementing an existence check before committing share records.

## Affected products

- filebrowser filebrowser < 2.63.7

## Identifiers

- CVE-2026-54096
- GHSA-3q2p-72cj-682c
- GO-2026-5096

## Timeline

- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: NVD publication date
- 2026-06-25: patched: Fix released in version 2.63.7

## References

- [https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2p-72cj-682c](https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2p-72cj-682c)

## Related threats

- [File Browser symlink alias path traversal bypass](https://junglewise.ai/threats/cve-2026-90930-file-browser-symlink-alias-path-traversal-bypass)
- [File Browser authorization bypass in direct-upload endpoint](https://junglewise.ai/threats/cve-2026-90929-file-browser-authorization-bypass-in-direct-upload-endpoint)
- [File Browser subtitle conversion memory exhaustion](https://junglewise.ai/threats/cve-2026-90928-file-browser-subtitle-conversion-memory-exhaustion)
- [File Browser stale share link exposure in cross-user file deletion](https://junglewise.ai/threats/cve-2026-82236-file-browser-stale-share-link-exposure-in-cross-user-file)
- [File Browser path-based access control bypass in recursive operations](https://junglewise.ai/threats/cve-2026-73612-file-browser-path-based-access-control-bypass-in-recursive)