CVE-2026-61874 — filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares be…
Published: 2026-07-12 · CVSS: 2.3 · CVSS 4.0
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7