CVE-2026-62683

Deferred Deferred - Pending Action

Path Traversal in File Browser

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser can leave a public directory share behind when the shared directory is deleted through a path with a trailing slash because the share cleanup path calls DeleteWithPathPrefix(file.Path, userID) and the Bolt backend performs the database prefix query with the unnormalized path before trimming the slash for boundary checks, so deleting /a/ does not delete the stored /a share and the stale public share exposes future content if the same path is recreated. This issue is fixed in version 2.63.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-62683

EUVD

EUVD-2026-44705

Affected Vendors & Products

Vendor	Product	Version / Range
filebrowser	file_browser	to 2.63.17 (exc)
filebrowser	file_browser	2.63.17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

File Browser before 2.63.17 had a flaw where deleting a shared directory with a trailing slash (e.g., /a/) did not remove the public share for /a. The cleanup process used an unnormalized path in the database query, missing the exact share row. This left a stale public share that could expose new content if the same path was recreated.

Detection Guidance

Check File Browser version with 'filebrowser version' or inspect the web interface footer. Look for public shares with trailing slashes in the share configuration. Review logs for share deletion attempts with paths ending in slashes.

Impact Analysis

An attacker with share, download, and delete permissions could exploit this by creating a public share, deleting the directory with a trailing slash, and later accessing the dormant share once the path is recreated. This could lead to unauthorized exposure of files in the recreated directory.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, potentially violating compliance requirements for data protection such as GDPR or HIPAA, which mandate strict controls over data access and sharing.

Mitigation Strategies

Upgrade to File Browser version 2.63.17 or later immediately. Manually verify all public shares exist only for intended directories. Audit share configurations for any paths with trailing slashes that may indicate stale shares.

Hi! I’m here to help you understand CVE-2026-62683. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70