What is the CVSS score of CVE-2026-62683?

CVE-2026-62683 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-62683?

Yes, a patch is available for CVE-2026-62683. Update the affected software to the latest version immediately.

File Browser CVE-2026-62683

EUVD-2026-44705 LOW

Incorrect Authorization (CWE-863)

2026-07-15 GitHub_M

Authentication Bypass Filebrowser

3.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

AC:H for the mandatory multi-step precondition chain; PR:L because directory deletion requires authentication; C:L as the sole impact is unauthorized read of files at the recreated path.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 16:19 vuln.today

Analysis Generated

Jul 15, 2026 - 16:19 vuln.today

DescriptionCVE.org

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser can leave a public directory share behind when the shared directory is deleted through a path with a trailing slash because the share cleanup path calls DeleteWithPathPrefix(file.Path, userID) and the Bolt backend performs the database prefix query with the unnormalized path before trimming the slash for boundary checks, so deleting /a/ does not delete the stored /a share and the stale public share exposes future content if the same path is recreated. This issue is fixed in version 2.63.17.

AnalysisAI

File Browser prior to 2.63.17 retains stale public directory share records after a shared directory is deleted via a trailing-slash path, because the Bolt storage backend queries for shares using the unnormalized path before trimming the slash - causing the exact-match share record (stored as '/a') to be missed by a query against '/a/'. If the directory is subsequently recreated at the same path, any holder of the original share URL immediately gains unauthorized read access to the new directory contents. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticated user creates public share for directory

Delivery

Directory deleted via trailing-slash API path

Exploit

Bolt prefix query misses stored share record

Execution

Stale share remains active in database

Persist

Administrator recreates directory at same path with new content

Impact

Share-link holder accesses new content via stale URL without authorization

Access

Authenticated user creates public share for directory

Delivery

Directory deleted via trailing-slash API path

Exploit

Bolt prefix query misses stored share record

Execution

Stale share remains active in database

Persist

Administrator recreates directory at same path with new content

Impact

Share-link holder accesses new content via stale URL without authorization

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following specific conditions to be met simultaneously: (1) A public share must have been previously created for a directory on the File Browser instance, stored in BoltDB as path '/X' (without trailing slash); (2) that directory must be deleted via the trailing-slash API path (e.g., 'DELETE /api/resources/X/'), which is the standard behavior of the File Browser web UI and REST API for directory resources - this requires the deleting user to have at least low-privilege authenticated access; (3) the same directory path must be subsequently recreated and populated with content. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-reported CVSS 3.1 score of 3.1 (Low) is consistent with the constrained exploitation scenario: AC:H reflects the multi-step precondition chain (active share exists, deletion must use trailing-slash path, and the same path must be recreated); PR:L confirms an authenticated user is required to trigger the deletion; and C:L bounds impact to unauthorized read of files placed at the recreated path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated low-privilege user creates a public share link for the directory '/a/' on a File Browser instance. The user (or an administrator) then deletes '/a/' through the standard web interface, which issues the request as 'DELETE /api/resources/a/' - triggering the buggy trailing-slash code path that leaves the '/a' share record intact in BoltDB. …
Remediation	Upgrade to File Browser version 2.63.17 or later, available at https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17. … Detailed patch versions, workarounds, and compensating controls in full report.