Description

filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by path, so it survives the rename and remains dormant (returning 404 while the path is empty). When any new, unrelated file later appears at the original shared path — via re-upload, another user with create permission, or a hook — the stale public share link serves that new file under the original link's password and expiry settings, unexpectedly exposing it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-28T12:16:33.587Z",
  "pubdate": "2026-08-28T12:16:33.587Z",
  "executiveSummary": "The vulnerability involves an improper state management issue within Filebrowser versions through 2.63.23, categorized as a logical flaw in how file shares are associated with filesystem paths.\nThe core issue is that share records are indexed strictly by file path rather than an immutable filesystem identifier. Consequently, when a shared file is renamed, the associated share record becomes 'stale' or orphaned but remains active in the database.\nThis creates an unauthorized access risk: if a new, unrelated file is subsequently created at the original path where the stale share record points, the system automatically binds the new file to the existing share link.\nAn attacker or unauthorized user can exploit this to gain access to newly uploaded or created content, provided they possess or can predict the previously generated share link.\nThe impact includes unintended data exposure, violation of access control policies, and loss of confidentiality for sensitive files uploaded to previously 'shared' locations.\nThis vulnerability does not require complex exploit code; it relies on the lifecycle management failure of the application's internal database relative to filesystem operations.",
  "technicalDetails": "The vulnerability resides in the internal logic governing resource sharing within Filebrowser (versions through 2.63.23). The system manages share records using the absolute path of the target file as the primary key. When a user creates a share, Filebrowser generates a public URL associated with that specific file path and stores the configuration (including password protection and expiration settings) in its database.\nThe root cause is a deficiency in the event-handling mechanism: the application triggers a share cleanup procedure exclusively upon the deletion of a file. It fails to monitor or hook into rename or move operations. When a user renames a file, the file's path changes, but the database record referencing the original path is never updated, invalidated, or deleted.\nThe resulting state is a 'dangling' share pointer. Initially, when the original path is vacant, the share link returns a 404 Not Found error because the requested file path no longer resolves to an object. However, the share record persists in the system's database in a dormant state.\nThe exploitation flow is as follows: 1) A user shares a file at /data/file.txt, generating a persistent link. 2) The owner renames /data/file.txt to /data/renamed.txt. The share link remains active but points to the now-vacant /data/file.txt. 3) At a later time, an attacker or another system process uploads a new, unrelated file to the exact path /data/file.txt. 4) Because the database share record is keyed by the path /data/file.txt, the system automatically associates the new, unrelated file with the existing, dormant share link.\nCrucially, the new file inherits the password requirements and expiration policies configured for the original share. If the original share had no password, the new file becomes publicly accessible via the old link without further authentication. This allows for unauthorized data exfiltration of new files by leveraging historical share metadata. The vulnerability is effective regardless of the user's privilege level if they can predict or have knowledge of historical share paths, and it remains active as long as the record exists in the Filebrowser database, regardless of how much time has passed since the file rename occurred."
}