Is there a patch available for CVE-2026-82236?

Yes, a patch is available for CVE-2026-82236. Update the affected software to the latest version immediately.

File Browser CVE-2026-82236

Q: What is the CVSS score of CVE-2026-82236?

CVE-2026-82236 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-67688 LOW

Incomplete Cleanup (CWE-459)

2026-08-28 VulnCheck

GHSA-9ccp-mqq4-gf52

Information Disclosure Filebrowser

2.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

Attacker needs only the share link token (PR:N); AC:H because exploitation requires a privileged deletion, path reuse, and link knowledge in sequence.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 28, 2026 - 12:08 vuln.today

Analysis Generated

Aug 28, 2026 - 12:08 vuln.today

DescriptionCVE.org

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication.

AnalysisAI

Stale public share links in File Browser 2.63.6-2.63.23 expose subsequently uploaded content to unauthenticated network access after a privileged user deletes another user's shared file without triggering proper link invalidation. Because the surviving share URL continues to resolve to whatever is later placed at the same storage path, an attacker who retains or discovers the original link can retrieve entirely unrelated files without authentication. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following conditions to occur in sequence: (1) a user must have created a public share link for a file or directory in File Browser 2.63.6-2.63.23; (2) a privileged user (e.g., an administrator) must delete that file or directory - not the owner themselves; (3) new, unrelated content must subsequently be uploaded to the identical storage path; and (4) the attacker must possess or independently discover the original share link token. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The real-world risk of this vulnerability is low despite its information-disclosure potential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade File Browser to a version incorporating commit 0231b7eb, available at https://github.com/filebrowser/filebrowser/commit/0231b7eb; the vendor advisory at https://github.com/filebrowser/filebrowser/security/advisories/GHSA-r6pg-pg54-rcr5 and the VulnCheck advisory at https://www.vulncheck.com/advisories/file-browser-2.63.6-through-2.63.23-share-link-exposure-via-file-deletion should be consulted for any confirmed patched release version, as an exact version number is not independently confirmed from the available data. … Detailed patch versions, workarounds, and compensating controls in full report.