filebrowser CVE-2026-61874

Exploitation requires an authenticated filebrowser account (PR:L per CVSS vector) with permission to create public shares and delete directories on a deployment running any version prior to 2.63.17. The specific trigger is issuing a directory deletion request using a trailing-slash path variant (e.g., /dirname/ instead of /dirname), which is the condition that bypasses share index cleanup in DeleteWithPathPrefix. Attack complexity is high (AC:H) because the attacker must orchestrate a delete-and-recreate sequence at the same path, and the confidentiality exposure depends on other users placing files in the recreated directory. Single-user self-hosted filebrowser instances face negligible practical risk. Exploitation is constrained to confidentiality only - there is no code execution, privilege escalation, or data modification vector.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) scores 2.3 and accurately reflects the constrained risk profile. PR:L confirms authentication is required; AC:H and AT:P together indicate that exploitation demands a specific multi-step sequence with attack prerequisites (the attacker must control a shared directory and successfully delete and recreate it at the same path). The confidentiality impact is limited to VC:L - partial exposure of newly-placed file contents through a stale share URL - with no integrity or availability impact. No CISA KEV listing and no identified public proof-of-concept code confirm this is not subject to active widespread exploitation. EPSS data was not provided; given the authentication requirement and high complexity, opportunistic mass exploitation is unlikely. Risk is primarily relevant to multi-tenant filebrowser deployments where malicious authenticated insiders can target files uploaded by other users to recreated directories.

An authenticated user on a shared filebrowser instance creates a public share for /team-docs/ and records the resulting public URL. The attacker then issues a delete request for /team-docs/ (with trailing slash), which bypasses path normalization in DeleteWithPathPrefix and leaves the share record intact. When any user later recreates the /team-docs/ directory and populates it with sensitive documents, those files are immediately accessible to anyone who holds the original public share URL, without any further action by the attacker.