PT-2026-57558 · Unknown · Filebrowser

Davidcarliez + 1 · Published 2026-07-12 · Updated 2026-07-12 · CVE-2026-61874

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions filebrowser versions prior to 2.63.17

Description Authenticated users can leave stale public shares behind because the software fails to normalize paths before querying the share index in the DeleteWithPathPrefix() function. An attacker can delete a shared directory by using a path with a trailing slash and subsequently recreate the directory to expose new contents via the dormant public share URL.

Recommendations Update to version 2.63.17 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-61874

Affected Products

Filebrowser

References · 6

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-pp88-jhwj-5qh5 · Vendor Advisory
• https://github.com/filebrowser/filebrowser/commit/be23ab3a15bf957928ecfed88de5ab67850c1b9c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-61874 · Security Note
• https://vulncheck.com/advisories/filebrowser-before-stale-public-share-via-trailing-slash-delete · Note
• https://twitter.com/CVEnew/status/2076339907627192370 · Twitter Post
• https://twitter.com/infoflowcloud/status/2076341053829845301 · Twitter Post