CVE-2026-61874: filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filebrowserto a version that resolves this vulnerability.Fixed in 2.63.17 - Compensating control
Ensure authenticated users do not have write/delete access to directories that are (or could become) exposed via public shares, to prevent trailing-slash DeleteWithPathPrefix abuse until FileBrowser is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61874?
The severity of CVE-2026-61874 is low with a score of 3.1.
How do I fix CVE-2026-61874?
To fix CVE-2026-61874, update Filebrowser to version 2.63.17 or later.
What does CVE-2026-61874 exploit?
CVE-2026-61874 exploits the failure of Filebrowser to normalize paths before querying the share index, allowing authenticated users to leave stale public shares.
Who is affected by CVE-2026-61874?
Authenticated users of Filebrowser versions before 2.63.17 are affected by CVE-2026-61874.
What is the impact of CVE-2026-61874?
The impact of CVE-2026-61874 allows attackers to delete and then recreate shared directories, potentially exposing new content.