CVE-2026-62683: Incorrect Authorization via Stale Public Shares in File Browser

Vulnerability ID: CVE-2026-62683
CVSS Score: 3.1
Published: 2026-11-13

File Browser versions prior to 2.63.17 contain an authorization and state-management flaw in the BoltDB storage backend. When an authenticated user deletes a shared directory via an HTTP request with a trailing slash (e.g., DELETE /api/resources/a/), the share cleanup routine queries the database index using the unnormalized path before stripping the trailing slash. Because canonical share paths are stored without trailing slashes (e.g., /a), the database prefix query fails to match the parent directory share record. If a directory with the same name is later recreated, the dormant public share hash automatically reactivates and exposes the new directory contents to unauthenticated users.

TL;DR

Deleting a shared directory via a path containing a trailing slash in File Browser prior to 2.63.17 fails to purge the public share entry from the database. Recreating the directory under the same path reactivates the stale share link, exposing new files to unauthenticated users.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability ID: CVE-2026-62683 / GHSA-pp88-jhwj-5qh5 / CVE-2026-61874
• Weakness Class: CWE-863 (Incorrect Authorization)
• CVSS v3.1 Score: 3.1 Low (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
• EPSS Score: 0.32% (24.77th Percentile)
• Affected Component: storage/bolt/share.go (DeleteWithPathPrefix)
• Affected Versions: File Browser < 2.63.17
• Patched Version: File Browser 2.63.17
• CISA KEV Status: Not Listed

Affected Systems

• File Browser (filebrowser/filebrowser)
• filebrowser: < 2.63.17 (Fixed in: 2.63.17)

Code Analysis

Commit: f30fca6

fix(share): delete exact directory share on trailing-slash delete (GHSA-pp88-jhwj-5qh5)

File: storage/bolt/share.go
@@ -78,16 +78,17 @@ func (s shareBackend) Delete(hash string) error {
 }

 func (s shareBackend) DeleteWithPathPrefix(pathPrefix string, userID uint) error {
+   // Share paths are stored without a trailing slash
+   prefix := strings.TrimRight(pathPrefix, "/")
+
    var links []share.Link
-   if err := s.db.Prefix("Path", pathPrefix, &links); err != nil {
+   if err := s.db.Prefix("Path", prefix, &links); err != nil {
        if errors.Is(err, storm.ErrNotFound) {
            return nil
        }
        return err
    }

-   prefix := strings.TrimRight(pathPrefix, "/")
-
    var err error
    for _, link := range links {
        if link.UserID != userID {

Commit: d76b7d1

Associated repository commit referenced in CVE advisories

Exploit Details

• GitHub: Official patch commit containing the unit regression test TestDeleteWithPathPrefixTrailingSlash demonstrating the bug.

Mitigation Strategies

• Upgrade File Browser to version 2.63.17 or later to ensure path normalization occurs before database prefix queries.
• Audit existing public share links in the BoltDB database (filebrowser.db) to identify and revoke orphaned shares created prior to upgrading.
• Enforce mandatory expiration dates and password protection on public share links to limit the exposure window of any stale shares.
• Configure reverse proxies to normalize URI paths or strip trailing slashes on DELETE requests to /api/resources/* as a temporary mitigation.

Remediation Steps:

1. Stop the running File Browser service.
2. Create a full backup of the BoltDB database file (filebrowser.db) and configuration files.
3. Download and deploy File Browser v2.63.17 or later from the official GitHub releases page (https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17).
4. Restart the File Browser service and verify the running version via 'filebrowser version'.
5. Review active shares in the Share Management interface or inspect the 'share' bucket in BoltDB to delete any stale share records pointing to deleted or recreated directories.

References

• GitHub Security Advisory GHSA-pp88-jhwj-5qh5
• CVE-2026-62683 Official CVE Record
• NVD Vulnerability Detail: CVE-2026-62683
• Fix Commit f30fca636c1af9ef401e9a82ff60391cb3db97e1
• File Browser Repository Commit d76b7d161099853f17e71b1327ce4545a30c27a2
• File Browser v2.63.17 Release Notes
• Duplicate CVE Record: CVE-2026-61874
• VulnCheck Advisory: File Browser Stale Public Share via Trailing-Slash Delete
• CVEListV5 JSON Record for CVE-2026-62683
• MITRE ATT&CK Reference for CVE-2026-62683
• Shodan CVEDB Entry for CVE-2026-62683
• CISA Known Exploited Vulnerabilities Catalog

Read the full report for CVE-2026-62683 on our website for more details including interactive diagrams and full exploit analysis.