CVE-2026-61874 | filebrowser versions before 2.63.17 fail to normalize paths … | CVSS 3.1 LOW

Description

filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.

Metadata

CVE ID: CVE-2026-61874
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-10 21:54 UTC
Published: 2026-07-12 12:06 UTC
Last updated: 2026-07-12 12:06 UTC
Primary CWE: CWE-863
Incorrect Authorization
Vendor / Product: filebrowser / filebrowser
Sources: cve.org · NVD

Severity & Metrics

3.1 LOW CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
filebrowser	filebrowser	—	0 < 2.63.17, 2.63.17

Weakness (CWE)

CWE	Source	Description
CWE-863	cna	Incorrect Authorization

CVSS scores (2)

Score	Severity	Version	Source	Vector
3.1	LOW	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
2.3	LOW	4.0	cna	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References (3)

GitHub Security Advisory (GHSA-pp88-jhwj-5qh5) https://github.com/filebrowser/filebrowser/security/advisories/GHSA-pp88-jhwj-5qh5
https://github.com/filebrowser/filebrowser/commit/be23ab3a15bf957928ecfed88de5ab67850c1b9c https://github.com/filebrowser/filebrowser/commit/be23ab3a15bf957928ecfed88de5ab67850c1b9c
VulnCheck Advisory: filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete https://www.vulncheck.com/advisories/filebrowser-before-stale-public-share-via-trailing-slash-delete