Popis
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.
CVSS 3.1EPSS 0.198%Riziko 0.32
Zobraziť zdroj- Zverejnené
- 2026-07-12 12:16:46
- Dotknuté verzie
- <2.63.17
- Typ
- Webová aplikácia
- Vektor
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N