File Browser CVE-2026-82236

Exploitation requires all of the following conditions to occur in sequence: (1) a user must have created a public share link for a file or directory in File Browser 2.63.6-2.63.23; (2) a privileged user (e.g., an administrator) must delete that file or directory - not the owner themselves; (3) new, unrelated content must subsequently be uploaded to the identical storage path; and (4) the attacker must possess or independently discover the original share link token. Exploitation is therefore limited to multi-tenant File Browser deployments where administrators actively manage other users' files and where the same storage paths are reused after deletion. Single-user deployments or deployments without public share functionality are not affected. The CVSS vector PR:L indicates some level of access is required, though accessing a functional public share URL itself requires only knowledge of the link token, not a platform account.

The real-world risk of this vulnerability is low despite its information-disclosure potential. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:L) correctly identifies high attack complexity and a prerequisite attack condition: exploitation requires a privileged user to delete another user's file, new content to be uploaded to the identical storage path, and the attacker to possess or discover the original share link - a narrow chain of dependent events. The confidentiality impact is limited to whatever single file is exposed at that path. No EPSS data was provided, and the vulnerability is not listed in the CISA KEV catalog, which is consistent with the low exploitability. There is no known public POC. The PR:L metric in the provided vector may reflect that the attacker requires at least the share link token itself, though accessing a public share URL technically requires no credentials once the token is known; this metric warrants verification against vendor intent. Overall, this is a genuine but low-priority flaw most relevant to multi-tenant File Browser deployments where users share files publicly and privileged administrators actively delete other users' content.

An attacker who received or discovered a public File Browser share link for /reports/q1.pdf learns that an administrator deleted the original file owner's copy of that document. When the administrator later uploads a sensitive /reports/q1.pdf (a new, unrelated file at the same path), the attacker simply accesses the original share URL and receives the new file's contents without any authentication. No exploit code is required; a standard HTTP GET to the surviving share URL is sufficient.