Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck

CVE-2026-82237filebrowser through 2.63.23 Stale Share Link via File Rename

Low 3.1

In plain English

A low-severity security flaw in filebrowser from filebrowser. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.2%top 88.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by path, so it survives the rename and remains dormant (returning 404 while the path is empty). When any new, unrelated file later appears at the original shared path — via re-upload, another user with create permission, or a hook — the stale public share link serves that new file under the original link's password and expiry settings, unexpectedly exposing it.

Affected products (as reported)

Vendor	Product	Versions
filebrowser	filebrowser	0 – through 2.63.23

Weakness: CWE-459 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-m8v4-4w34-rrvf) vendor-advisory
VulnCheck Advisory: filebrowser through 2.63.23 Stale Share Link via File Rename third-party-advisory