File Browser, a web‑based file management interface, contains a path traversal flaw in the handling of public share links. When a user creates a link for a directory, the system incorrectly resolves the base path to the directory’s parent rather than the directory itself, permitting unauthenticated users who possess the link to view and download any sibling files. This oversight is an Information Disclosure vulnerability (CWE‑200) and can expose sensitive data outside the intended shared folder.

The flaw affects all File Browser installations running any version earlier than 2.61.0, including the 2.60.x releases. Later releases are unaffected.

The CVSS score of 7.1 indicates a medium‑to‑high severity, while the EPSS value of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA catalog of known exploited vulnerabilities, and no public exploit has been reported. It can be exploited by any user who obtains a public share link; the attacker does not need any credentials and can traverse into sibling directories to retrieve files.