CVE-2026-62683 Details
Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser can leave a public directory share behind when the shared directory is deleted through a path with a trailing slash because the share cleanup path calls DeleteWithPathPrefix(file.Path, userID) and the Bolt backend performs the database prefix query with the unnormalized path before trimming the slash for boundary checks, so deleting /a/ does not delete the stored /a share and the stale public share exposes future content if the same path is recreated. This issue is fixed in version 2.63.17.
A vulnerability in File Browser versions prior to 2.63.17 allows for the improper deletion of public directory shares. When a directory is deleted using a path that includes a trailing slash, the corresponding share is not removed, leaving a stale link that can expose future content if the directory is recreated. This issue arises because the share deletion process does not properly normalize the path before querying the database, causing it to miss the exact share entry.
Users can update to File Browser version 2.63.17, which normalizes the path before deleting shares, ensuring that both the exact share and its descendants are removed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-pp88-jhwj-5qh5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/filebrowser/filebrowser/commit/f30fca636c1af9ef401e9a82ff60391cb3db97e1 | [email protected] | Source CodeVendor |
| https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17 | [email protected] | Release NotesVendor |
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-pp88-jhwj-5qh5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| File Browser | <= 2.63.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |