Is CVE-2026-82236 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82236 being exploited in the wild.

How severe is CVE-2026-82236?

Low severity, with a CVSS score of 3.1, published 28 August 2026.

Which products and versions are affected?

File Browser 2.63.6 through 2.63.23.

Is there a fix for CVE-2026-82236?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82236 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82236?

Check whether you run File Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82236: File Browser stale share link exposure in cross-user file deletion

CVE-2026-82236 · Severity: low · CVSS 3.1 · Published 2026-08-28

File Browser is a web-based file manager used to browse, upload, and share files. When a privileged user (such as an administrator) deletes a file that another user has publicly shared, the system fails to clean up the original share link. Attackers with access to the surviving link can retrieve any new file later uploaded to the same path without authentication, potentially exposing sensitive content that was never intended to be shared.

Technologies: File Browser. Vendors: File Browser.

Quick answers

Is CVE-2026-82236 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82236 being exploited in the wild.
How severe is CVE-2026-82236?: Low severity, with a CVSS score of 3.1, published 28 August 2026.
Which products and versions are affected?: File Browser 2.63.6 through 2.63.23.
Is there a fix for CVE-2026-82236?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82236 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82236?: Check whether you run File Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

File Browser versions 2.63.6 through 2.63.23 contain a logic error in the file deletion handler: when a file is deleted, share cleanup is filtered to only remove links owned by the deleting user (via DeleteWithPathPrefix passing the deleter's user ID). If a privileged user deletes a file that another user had publicly shared, the share owner's link record survives. When a new file is later created at the same path, the stale unauthenticated link — including any original password and expiry restrictions — serves the new content. Attack vector requires the ability to delete files scoped to another user's shared path (e.g., admin cleanup, overlapping scopes). The fix introduced in version 2.63.6 was specifically designed to prevent cross-user share deletion, making this a regression. The project is no longer maintained and no patch will be released.

Affected products

File Browser File Browser 2.63.6 through 2.63.23

Timeline

2026-08-14: disclosed
2026-08-28: other: CVE-2026-82236 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.