Descrição
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.
CVSS 3.1EPSS 0.198%Risco 0.32
Ver fonte- Publicação
- 2026-07-12 12:16:46
- Versões afetadas
- <2.63.17
- Tipo
- Aplicação web
- Vetor
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N