Is there a patch available for CVE-2026-61874?

Yes, a patch is available for CVE-2026-61874. Update the affected software to the latest version immediately.

filebrowser CVE-2026-61874

Q: What is the CVSS score of CVE-2026-61874?

CVE-2026-61874 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43234 LOW

Incorrect Authorization (CWE-863)

2026-07-12 VulnCheck

GHSA-7cj6-cw3p-4jpw

Authentication Bypass Filebrowser

2.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

Network-reachable but requires authenticated access (PR:L) and a specific trailing-slash delete/recreate sequence (AC:H); confidentiality impact is partial via stale share URL only (C:L), no integrity or availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 12:52 vuln.today

DescriptionCVE.org

filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.

AnalysisAI

Path normalization failure in filebrowser's DeleteWithPathPrefix function allows authenticated users on versions before 2.63.17 to leave stale public share records intact by deleting directories with trailing-slash paths. After deletion, an attacker can recreate the same directory path and cause its new contents to be silently exposed through the previously dormant, still-valid public share URL. No public exploit code has been identified at time of analysis, and the vendor-confirmed CVSS 4.0 score of 2.3 reflects the high complexity and limited confidentiality impact.

Technical ContextAI

filebrowser is a self-hosted web-based file management application. The flaw resides in DeleteWithPathPrefix, the function responsible for cleaning up share index entries when a directory is removed. Because the function does not normalize the supplied path before querying the share index, a trailing-slash variant of a directory path (e.g., /shared-dir/ rather than /shared-dir) fails to match the indexed share record, leaving that record orphaned. CWE-863 (Incorrect Authorization) classifies this root cause: the authorization enforcement for share lifecycle management is incomplete because it silently ignores path variants, producing a broken invariant where a logically deleted resource retains a live public access token. The CPE string cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:* indicates all filebrowser versions are potentially in scope, bounded by the fix in 2.63.17.

RemediationAI

Upgrade filebrowser to version 2.63.17 or later, which incorporates the fix committed at https://github.com/filebrowser/filebrowser/commit/be23ab3a15bf957928ecfed88de5ab67850c1b9c. Administrators who cannot immediately patch should audit all active public shares via the admin interface and manually revoke any shares referencing directories that have previously been deleted and recreated; this eliminates existing stale share entries without requiring an upgrade. As an alternative compensating control, disabling public share functionality entirely removes the attack surface at the cost of losing the file-sharing feature for all users. Restricting directory deletion permissions to administrators only limits the pool of potential attackers in multi-tenant deployments but does not eliminate the underlying flaw.