EUVD-2026-67689
GHSA-v6g4-hccq-frhr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible stale link requires low-privilege auth to create initial share; high complexity due to multi-step path aliasing precondition; confidentiality impact only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by path, so it survives the rename and remains dormant (returning 404 while the path is empty). When any new, unrelated file later appears at the original shared path - via re-upload, another user with create permission, or a hook - the stale public share link serves that new file under the original link's password and expiry settings, unexpectedly exposing it.
AnalysisAI
Stale public share links in filebrowser through 2.63.23 can silently redirect to unrelated files uploaded after a rename operation, unexpectedly exposing new content to anyone holding the original link. The defect (CWE-459, Incomplete Cleanup) arises because share records are keyed by file path rather than a file identifier - deletion triggers cleanup, but rename does not, leaving the share dormant. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must align for exploitation: (1) A file must have been shared via filebrowser's public share feature at a specific path, and that share link distributed to at least one external party. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.3 accurately reflects the compounded preconditions: AC:H indicates high attack complexity, and AT:P captures the partial attack requirements - specifically that a new file must independently arrive at the original path for the stale share to activate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the vendor security advisory at https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m8v4-4w34-rrvf for the official fix version; no specific patched release version was confirmed in the available intelligence at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Filebrowser
View allUnauthorized file operations in File Browser before fix. PoC and patch available.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Filebrowser versions prior to 2.57.1 allow authenticated users to reset passwords without verifying the current password
Path traversal in FileBrowser Quantum (gtsteffaniak fork) versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta all
Same weakness CWE-459 – Incomplete Cleanup
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today