CVE-2026-54097 Details
Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, a low-privileged authenticated user of filebrowser (with create + delete permissions in their own isolated scope) can silently destroy share-link records belonging to any other user — including the administrator — by performing a legitimate DELETE on a file in their own directory whose logical path happens to be a byte-prefix of another user's stored share.Link.Path. The file contents of the victim are not exposed, but the victim's share links are irrevocably wiped. This vulnerability is fixed in 2.63.6.
A vulnerability in File Browser prior to version 2.63.6 allows low-privileged authenticated users to delete share-link records of other users, including administrators. This is achieved by deleting a file in their own directory that shares a byte-prefix with another user's share link path. The deletion of the file removes the corresponding share link from the database, causing an irreversible loss of that share link. The vulnerability arises because the file deletion process does not properly enforce ownership rules, allowing users to manipulate share links that do not belong to them.
Users can upgrade to File Browser version 2.63.6 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/filebrowser/filebrowser/commit/0231b7ebdfbe77a6c54027d30c4856c3fd81ee4d | [email protected] | Source CodeVendor |
| https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6 | [email protected] | Release NotesVendor |
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5ww9-jg6q-38r7 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| File Browser | <= 2.63.5 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |