CVE-2026-35604 — File Browser share links remain accessible after Share/Download permissions are revoked
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a…
Published: 2026-04-07 · CVSS: 8.2 · CVSS 4.0
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner's current permissions. This vulnerability is fixed in 2.63.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7