Descripción
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.
CVSS 3.1EPSS 0.198%Riesgo 0.32
Ver fuente- Publicación
- 2026-07-12 12:16:46
- Versiones afectadas
- <2.63.17
- Tipo
- Aplicación web
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N