File Browser was found to allow an authenticated user to create a public share for any specified path, even if the target file did not yet exist. When a file is later created at that path, the pre‑created share becomes valid and can be used to download the new file via an unauthenticated endpoint. This flaw permits authenticated attackers to expose arbitrary files publicly, compromising confidentiality without needing further privileges.

The vulnerability affects the File Browser product from the filebrowser vendor. All released versions prior to 2.63.7 (including 2.63.6 and earlier) are impacted. No other vendors or products are listed.

With a CVSS score of 8.4 the risk is high. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. An attack requires valid user credentials to create the share; once the share is created, an unauthenticated download is possible. The flaw is sufficiently exploitable that an attacker with authentication can achieve public data exposure quickly.