CVE-2026-54096

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

Published Jun 25, 2026 CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, `POST /api/share/<path>` accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created public share immediately becomes valid and exposes the new file through `GET /api/public/dl/<hash>`. This vulnerability is fixed in 2.63.7.

Analysis

Technical impact

File Browser was found to allow an authenticated user to create a public share for any specified path, even if the target file did not yet exist. When a file is later created at that path, the pre‑created share becomes valid and can be used to download the new file via an unauthenticated endpoint. This flaw permits authenticated attackers to expose arbitrary files publicly, compromising confidentiality without needing further privileges.

Affected Systems

The vulnerability affects the File Browser product from the filebrowser vendor. All released versions prior to 2.63.7 (including 2.63.6 and earlier) are impacted. No other vendors or products are listed.

Risk and Exploitability

With a CVSS score of 8.4 the risk is high. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. An attack requires valid user credentials to create the share; once the share is created, an unauthenticated download is possible. The flaw is sufficiently exploitable that an attacker with authentication can achieve public data exposure quickly.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

filebrowser

affected

Version	Status	Constraints
`< 2.63.7`	affected	—

No data.

Vendor Product Versions

Filebrowser

Version	Status	Scheme	Platform
`[0,2.63.7)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update File Browser to version 2.63.7 or later, which validates file existence before creating a public share.
Revoke or restrict the credentials of users who can create public shares if an immediate upgrade is not possible.
Implement monitoring to detect unexpected creation of public shares for non‑existent paths and investigate any anomalies.

Generated by OpenCVE AI on June 25, 2026 at 19:29 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-3q2p-72cj-682c	File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.182% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2p-72cj-682c

History

Jun 25, 2026 9:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Filebrowser Filebrowser filebrowser
Vendors & Products		Filebrowser Filebrowser filebrowser

Jun 25, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 25, 2026 6:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, `POST /api/share/<path>` accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created public share immediately becomes valid and exposes the new file through `GET /api/public/dl/<hash>`. This vulnerability is fixed in 2.63.7.
Title		File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path
Weaknesses		CWE-863
References		https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2p-72cj-682c
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`