CVE-2026-54097: File Browser authorization bypass in share-link deletion

CVE-2026-54097 · Severity: high · CVSS 4 · Published 2026-06-25

File Browser is a web-based file management interface used to upload, edit, and share files. A security flaw allows a standard user to accidentally or intentionally delete the "share links" created by other users, including administrators. While the actual files remain safe, the links used to share those files with others are permanently destroyed, causing a disruption in operations and data sharing workflows.

Technologies: File Browser, github.com/filebrowser/filebrowser (Go), github.com/filebrowser/filebrowser/v2 (Go). Vendors: File Browser, Go.

Quick answers

Is CVE-2026-54097 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54097 being exploited in the wild.
How severe is CVE-2026-54097?
High severity, with a CVSS score of 4, published 25 June 2026.
Which products and versions are affected?
File Browser < 2.63.6; github.com/filebrowser/filebrowser (Go) <= 1.11.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.11.0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.5, SEMVER:introduced=0,fixed=2.63.6.
Is there a fix for CVE-2026-54097?
Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54097 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54097?
Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later
    go get github.com/filebrowser/filebrowser/v2@v2.63.6

Technical details

An authorization bypass exists in the 'DeleteWithPathPrefix' function within the Bolt storage backend. When a user deletes a file, the 'resourceDeleteHandler' attempts to clean up associated share links by matching the logical path prefix. Because this cleanup process does not verify the 'UserID' associated with the share links, a malicious user can delete a file with a short name (e.g., a single character) to trigger a prefix match that wipes share links belonging to other users, including administrators. This occurs because the application uses the logical path from the request rather than an absolute or user-scoped path. The vulnerability is fixed in version 2.63.6.

Affected products

  • filebrowser filebrowser < 2.63.6

Identifiers

  • CVE-2026-54097
  • GHSA-5ww9-jg6q-38r7
  • GO-2026-5159

Timeline

  • 2026-06-03: patched: Version 2.63.6 released
  • 2026-06-25: disclosed: CVE-2026-54097 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.