Executive brief
File Browser is a web-based file manager used to browse, upload, and share files. When a privileged user (such as an administrator) deletes a file that another user has publicly shared, the system fails to clean up the original share link. Attackers with access to the surviving link can retrieve any new file later uploaded to the same path without authentication, potentially exposing sensitive content that was never intended to be shared.
Technical details
File Browser versions 2.63.6 through 2.63.23 contain a logic error in the file deletion handler: when a file is deleted, share cleanup is filtered to only remove links owned by the deleting user (via DeleteWithPathPrefix passing the deleter's user ID). If a privileged user deletes a file that another user had publicly shared, the share owner's link record survives. When a new file is later created at the same path, the stale unauthenticated link — including any original password and expiry restrictions — serves the new content. Attack vector requires the ability to delete files scoped to another user's shared path (e.g., admin cleanup, overlapping scopes). The fix introduced in version 2.63.6 was specifically designed to prevent cross-user share deletion, making this a regression. The project is no longer maintained and no patch will be released.
Affected products
- File Browser File Browser 2.63.6 through 2.63.23
Timeline
- 2026-08-14: disclosed
- 2026-08-28: other: CVE-2026-82236 published