File Browser, an interface for file operations, contains a flaw that causes a shared directory to remain publicly accessible after deletion if the path ends with a trailing slash. The bug lies in how the backend processes path prefixes during cleanup, leaving the underlying share record in place. As a result, any new files placed under the same directory name can be viewed by anyone with access to the stale share, constituting an unintended disclosure of data. The weakness originates from improper path normalization, identified as CWE‑863.

The issue affects the File Browser application, distributed under the filebrowser vendor. Versions prior to 2.63.17 are vulnerable. Users running filebrowser:filebrowser v2.63.16 or earlier, especially those that have shared directories configured, are at risk.

The severity is low with a CVSS score of 3.1 and an EPSS score of less than 1 percent, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would require the ability to delete a shared directory through the File Browser interface and providing a path that ends with a slash. Attackers with such access could create new content that becomes public via the stale share, leading to confidentiality compromise. Because of the limited scope and low probability of exploitation, the overall risk is moderate but the issue can be fully mitigated by updating to a patched version.