File Browser permits a low‑privileged authenticated user, with create and delete permissions only in their own scoped directory, to silently erase share‑link records of any other user, including administrators, by sending a legitimate DELETE request for a file whose logical path is a byte‑prefix of another user’s stored share link path. The victim’s file data remain protected, but the shared access granted to the victim is irreversibly lost. This flaw represents a privilege escalation and unauthorized data deletion vulnerability, identified as CWE‑639.

The vulnerability affects File Browser releases prior to version 2.63.6. Users running any 2.x series filebrowser instance before the v2.63.6 release are impacted. A patch that resolves the issue is available in the 2.63.6 tag of the project."

The flaw carries a CVSS score of 7.2, indicating a high severity but moderate exploitability. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely publicized exploits yet. Attack requires authenticated access with create and delete permissions, meaning that any authenticated user with those minimal rights could exploit the bug by accessing a file path that is a prefix of another user's share link. The risk is elevated for environments where user accounts have these permissions, particularly if share links are commonly used for external access.