# CVE-2026-62683: File Browser incorrect authorization via stale public shares

Source: https://junglewise.ai/threats/cve-2026-62683-file-browser-incorrect-authorization-via-stale-public-shares  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-62683 · Severity: low · CVSS 3.1 · Published 2026-07-15

File Browser, a web-based file management interface, contains a flaw where deleting a folder using a path with a trailing slash (e.g., "/folder/") fails to remove its associated public sharing link. This results in a "stale" share remaining in the system's database even after the original files are gone. If a user later creates a new folder with the same name, the old public link will automatically become active again, potentially exposing new, private files to anyone who has the original sharing URL.

Technologies: [File Browser](https://junglewise.ai/threats/technologies/file-browser). Vendors: [File Browser](https://junglewise.ai/threats/vendors/file-browser).

## Quick answers

**Is CVE-2026-62683 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62683 being exploited in the wild.

**How severe is CVE-2026-62683?** Low severity, with a CVSS score of 3.1, published 15 July 2026.

**Which products and versions are affected?** File Browser < 2.63.17.

**Is there a fix for CVE-2026-62683?** A patch was published on 2026-06-27: Version 2.63.17 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62683 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-62683?** Check whether you run File Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in File Browser's Bolt backend where the `DeleteWithPathPrefix` function performs database queries using unnormalized paths. When a directory is deleted via a path containing a trailing slash (e.g., `/a/`), the database prefix query fails to match the exact stored share path (e.g., `/a`), though it may match descendants. Consequently, the directory is removed from the filesystem, but the public share record persists in the database. If a directory is later recreated at the same path, the stale share record becomes active, allowing unauthenticated access to the new content via the original share hash. This issue is resolved in version 2.63.17 by normalizing paths before the prefix query.

## Affected products

- filebrowser File Browser < 2.63.17

## Timeline

- 2026-06-27: patched: Version 2.63.17 released
- 2026-06-28: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD

## References

- [https://github.com/filebrowser/filebrowser/commit/f30fca636c1af9ef401e9a82ff60391cb3db97e1](https://github.com/filebrowser/filebrowser/commit/f30fca636c1af9ef401e9a82ff60391cb3db97e1)
- [https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17](https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17)
- [https://github.com/filebrowser/filebrowser/security/advisories/GHSA-pp88-jhwj-5qh5](https://github.com/filebrowser/filebrowser/security/advisories/GHSA-pp88-jhwj-5qh5)

## Related threats

- [File Browser symlink alias path traversal bypass](https://junglewise.ai/threats/cve-2026-90930-file-browser-symlink-alias-path-traversal-bypass)
- [File Browser authorization bypass in direct-upload endpoint](https://junglewise.ai/threats/cve-2026-90929-file-browser-authorization-bypass-in-direct-upload-endpoint)
- [File Browser subtitle conversion memory exhaustion](https://junglewise.ai/threats/cve-2026-90928-file-browser-subtitle-conversion-memory-exhaustion)
- [File Browser stale share link exposure in cross-user file deletion](https://junglewise.ai/threats/cve-2026-82236-file-browser-stale-share-link-exposure-in-cross-user-file)
- [File Browser path-based access control bypass in recursive operations](https://junglewise.ai/threats/cve-2026-73612-file-browser-path-based-access-control-bypass-in-recursive)