# CVE-2026-54097: File Browser authorization bypass in share-link deletion

Source: https://junglewise.ai/threats/cve-2026-54097-file-browser-authorization-bypass-in-share-link-deletion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-54097 · Severity: high · CVSS 4 · Published 2026-06-25

File Browser is a web-based file management interface used to upload, edit, and share files. A security flaw allows a standard user to accidentally or intentionally delete the "share links" created by other users, including administrators. While the actual files remain safe, the links used to share those files with others are permanently destroyed, causing a disruption in operations and data sharing workflows.

Technologies: [File Browser](https://junglewise.ai/threats/technologies/file-browser), [github.com/filebrowser/filebrowser (Go)](https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser), [github.com/filebrowser/filebrowser/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser-v2). Vendors: [File Browser](https://junglewise.ai/threats/vendors/file-browser), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-54097 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54097 being exploited in the wild.

**How severe is CVE-2026-54097?** High severity, with a CVSS score of 4, published 25 June 2026.

**Which products and versions are affected?** File Browser < 2.63.6; github.com/filebrowser/filebrowser (Go) <= 1.11.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.11.0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.5, SEMVER:introduced=0,fixed=2.63.6.

**Is there a fix for CVE-2026-54097?** Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54097 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54097?** Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later

  ```sh
  go get github.com/filebrowser/filebrowser/v2@v2.63.6
  ```


## Technical details

An authorization bypass exists in the 'DeleteWithPathPrefix' function within the Bolt storage backend. When a user deletes a file, the 'resourceDeleteHandler' attempts to clean up associated share links by matching the logical path prefix. Because this cleanup process does not verify the 'UserID' associated with the share links, a malicious user can delete a file with a short name (e.g., a single character) to trigger a prefix match that wipes share links belonging to other users, including administrators. This occurs because the application uses the logical path from the request rather than an absolute or user-scoped path. The vulnerability is fixed in version 2.63.6.

## Affected products

- filebrowser filebrowser < 2.63.6

## Identifiers

- CVE-2026-54097
- GHSA-5ww9-jg6q-38r7
- GO-2026-5159

## Timeline

- 2026-06-03: patched: Version 2.63.6 released
- 2026-06-25: disclosed: CVE-2026-54097 published

## References

- [https://github.com/filebrowser/filebrowser/commit/0231b7ebdfbe77a6c54027d30c4856c3fd81ee4d](https://github.com/filebrowser/filebrowser/commit/0231b7ebdfbe77a6c54027d30c4856c3fd81ee4d)
- [https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6](https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6)
- [https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5ww9-jg6q-38r7](https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5ww9-jg6q-38r7)

## Related threats

- [File Browser symlink alias path traversal bypass](https://junglewise.ai/threats/cve-2026-90930-file-browser-symlink-alias-path-traversal-bypass)
- [File Browser authorization bypass in direct-upload endpoint](https://junglewise.ai/threats/cve-2026-90929-file-browser-authorization-bypass-in-direct-upload-endpoint)
- [File Browser subtitle conversion memory exhaustion](https://junglewise.ai/threats/cve-2026-90928-file-browser-subtitle-conversion-memory-exhaustion)
- [File Browser stale share link exposure in cross-user file deletion](https://junglewise.ai/threats/cve-2026-82236-file-browser-stale-share-link-exposure-in-cross-user-file)
- [File Browser path-based access control bypass in recursive operations](https://junglewise.ai/threats/cve-2026-73612-file-browser-path-based-access-control-bypass-in-recursive)