Περιγραφή
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.
CVSS 3.1EPSS 0.198%Κίνδυνος 0.32
Προβολή πηγής- Δημοσίευση
- 2026-07-12 12:16:46
- Επηρεαζόμενες εκδόσεις
- <2.63.17
- Τύπος
- Εφαρμογή ιστού
- Διάνυσμα
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N