File Browser versions prior to 2.63.17 serialize the link storage struct directly in the share API handlers, revealing the password_hash and bypass token for each share. An administrator or any actor with administrator privileges can retrieve these secrets for all users’ shares, enabling offline password cracking and direct access to protected shares without requiring the original passwords.

The vulnerability affects the open‑source file browsing application File Browser, specifically all releases before version 2.63.17. Users running older versions are at risk of having their share credentials exposed.

The CVSS score of 2.7 indicates a low severity issue and the EPSS score is not available, implying little to no publicly documented exploitation. The vulnerability requires administrative access to the application; it is therefore unlikely to be exploited by unauthenticated attackers. The risk is moderate in environments where administrators are compromised or weakly protected, but overall it does not pose an immediate high‑risk threat to the general public.