CVE-2026-82237
Received Received - Intake

Filebrowser Share Link Exposure via Path Reuse

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description
filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by path, so it survives the rename and remains dormant (returning 404 while the path is empty). When any new, unrelated file later appears at the original shared path — via re-upload, another user with create permission, or a hook — the stale public share link serves that new file under the original link's password and expiry settings, unexpectedly exposing it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-82237
EUVD
EUVD-2026-67689

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
filebrowser filebrowser to 2.63.23 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

filebrowser through 2.63.23 fails to remove share records when a shared file is renamed. The share record remains dormant and keyed by the original path. If a new file later appears at that path, the stale share link may serve the new file, exposing it unexpectedly.

Detection Guidance

To detect this vulnerability, check for stale share links by inspecting file paths that no longer exist but have active shares. Review FileBrowser's share records and compare them with current file paths. Look for share links tied to empty or renamed paths.

Impact Analysis

This vulnerability could lead to unintended exposure of files. If a shared file is renamed, the original share link might later serve a different file placed at the same path, potentially leaking sensitive data to unauthorized users.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive files to unauthorized parties through stale share links. Organizations may face compliance breaches if data leaks occur due to this issue.

Mitigation Strategies

Upgrade filebrowser to a version later than 2.63.23 where share records are properly cleaned up after file renames. Review all existing share links to ensure they point to the correct files and remove any stale shares.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82237. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart