Description

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-28T12:16:33.420Z",
  "pubdate": "2026-08-28T12:16:33.420Z",
  "executiveSummary": "This vulnerability involves an Improper Neutralization of Special Elements and lack of state synchronization in File Browser versions 2.63.6 through 2.63.23.\nThe security flaw manifests when a privileged user deletes a shared file, yet the associated public share link persists within the application database.\nThis creates an orphan share entry that remains active despite the deletion of the original resource.\nThe primary impact is unauthorized access to files subsequently uploaded to the same filesystem path previously occupied by the original shared content.\nThe vulnerability allows an unauthenticated attacker, who possesses the persistent URL, to gain access to potentially sensitive files uploaded by other users without requiring active session tokens or authorization.\nThe risk is categorized as high due to the potential for sensitive data exposure and the bypass of access control mechanisms.\nExploitation requires no authentication; however, the attacker must have knowledge of or discover the persistent share link and rely on a race condition or temporal coincidence where a new file occupies the exact namespace of the deleted resource.",
  "technicalDetails": "The root cause of this vulnerability lies in the decoupling of the File Browser file system operations and the metadata management of the internal share database. When a file is removed via a privileged user's intervention, the application deletes the object from the physical storage layer but fails to initiate a corresponding cascaded delete or record invalidation in the shares database table.\nThe affected component is the share management module responsible for mapping public URLs to specific file paths. In File Browser versions 2.63.6 through 2.63.23, the share link creation logic generates a pointer to a specific file system path. Because the application logic does not proactively monitor for the destruction of the underlying inode or path target, the database retains the pointer.\nThe attack flow proceeds as follows: First, a legitimate user creates a public share link for a file stored at a specific path. Second, a privileged user deletes that specific file from the application interface, intending to destroy both the resource and its associated access permissions. Third, the application succeeds in physical deletion but maintains the database entry for the share URL. Fourth, if a different user subsequently uploads a new file to the exact same directory path and filename, the persistent, unauthenticated URL now resolves to the new, unrelated content.\nThe exposure is strictly unauthorized, as the share link bypasses the standard authentication middleware intended for the File Browser application. An attacker possessing the original URL can programmatically poll or re-access the link to retrieve the newly uploaded content. Since the share token is not revoked upon the deletion of the source file, the link effectively acts as a permanent, blind entry point for the specified directory path. This condition persists indefinitely unless the application state is manually reconciled or the share record is purged from the backend database by an administrator. The vulnerability relies on the predictability of file paths, often facilitated by standardized naming conventions or user behavior, to map the persistent share to the new content."
}