CVE-2026-61874 | BDVDB-2026-347183 Detail

Description#

filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-12Record published in the CVE List.
2. Version 22026-07-14Most recent update recorded in the CVE List.