CVE-2026-54096 Details
Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, `POST /api/share/<path>` accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created public share immediately becomes valid and exposes the new file through `GET /api/public/dl/<hash>`. This vulnerability is fixed in 2.63.7.
An improper access control vulnerability has been identified in File Browser versions prior to 2.63.7. The issue arises in the file sharing feature, where the application allows users to create public share links for arbitrary file paths without verifying if the files actually exist. This vulnerability can be exploited by first creating a share link for a non-existent file, and then later uploading a file to that path. Once the file is uploaded, the public share link can be used to access the file, effectively bypassing the intended access control mechanisms.
Users can update to File Browser version 2.63.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2p-72cj-682c | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2p-72cj-682c | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| File Browser | <= 2.63.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | New CVE Received | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |