CVE-2026-61874: FileBrowser Auth Bypass Vulnerability

CVE-2026-61874 Overview

CVE-2026-61874 affects filebrowser versions before 2.63.17. The application fails to normalize paths before querying the share index in the DeleteWithPathPrefix function. Authenticated users can exploit this flaw to leave stale public shares behind by deleting a shared directory using a trailing-slash path. Attackers then recreate the same directory to expose new contents through the dormant public share URL. The root weakness maps to CWE-863: Incorrect Authorization. The vulnerability requires authenticated access and offers limited confidentiality impact, but it enables persistent unauthorized data exposure through resurrected share links.

Critical Impact
Authenticated users can resurrect stale public share URLs and expose newly created content to unauthenticated visitors on the internet.

Affected Products

filebrowser versions prior to 2.63.17
Deployments exposing the share feature to authenticated users
Self-hosted filebrowser instances reachable over the network

Discovery Timeline

2026-07-12 - CVE-2026-61874 published to the National Vulnerability Database
2026-07-13 - Last updated in the NVD database

Technical Details for CVE-2026-61874

Vulnerability Analysis

The flaw resides in filebrowser's share management logic. When a directory is deleted, the application invokes DeleteWithPathPrefix to purge any associated public share records from the share index. This cleanup routine performs a path prefix comparison without first normalizing the input path. A trailing slash appended to the target directory causes the lookup to miss the corresponding share entry. The directory removal proceeds, but the share record remains active in the index. The public share URL continues to resolve after deletion, pointing at a dormant path. Recreating a directory with the same name attaches new files to the resurrected share, exposing them to any visitor holding the original URL.

Root Cause

The root cause is missing path canonicalization prior to authorization and index lookups. filebrowser compares raw user-supplied paths against stored share identifiers instead of normalized forms. Trailing slashes, redundant separators, and similar variants bypass the equality check that would otherwise invalidate the share. This mismatch violates the assumption that share cleanup executes atomically with directory deletion.

Attack Vector

Exploitation requires an authenticated account with permission to create, share, and delete directories. The attacker shares a directory publicly, records the generated share URL, and then deletes the directory using a path with a trailing slash. The share record survives the delete operation. The attacker recreates a directory of the same name and populates it with content. Anyone possessing the original share URL, including external parties, retrieves the new content without authentication. See the GitHub Security Advisory GHSA-pp88-jhwj-5qh5 and the VulnCheck Advisory for additional detail.

Detection Methods for CVE-2026-61874

Indicators of Compromise

Public share URLs that resolve successfully after the underlying directory was deleted and recreated
Application logs showing DELETE requests targeting directory paths with trailing slashes followed by rapid directory recreation
Share index entries referencing paths that no longer match any active directory owner or creation timestamp

Detection Strategies

Audit the filebrowser share index and compare each entry against the current filesystem state to identify orphaned share records
Review HTTP request logs for DELETE operations where the path terminates in / immediately preceded or followed by share creation events
Correlate share access logs with directory creation timestamps to detect content served through shares older than the directory itself

Monitoring Recommendations

Enable verbose access logging on the filebrowser reverse proxy and forward events to a centralized logging platform
Alert on any unauthenticated access to public share endpoints originating from unexpected source addresses
Track share creation and deletion rates per user account and flag anomalies that deviate from established baselines

How to Mitigate CVE-2026-61874

Immediate Actions Required

Upgrade filebrowser to version 2.63.17 or later on all deployments
Enumerate the existing share index and revoke any shares that reference paths no longer tied to their original directories
Restrict share creation privileges to trusted user roles until the upgrade is complete

Patch Information

The filebrowser maintainers addressed the issue in commit be23ab3a15bf957928ecfed88de5ab67850c1b9c. The fix normalizes the path before querying the share index inside DeleteWithPathPrefix, ensuring stale share entries are purged regardless of trailing separators. Version 2.63.17 contains the corrected logic. Administrators should validate the running version after upgrade and confirm the share index reconciles with the current filesystem.

Workarounds

Disable public sharing at the configuration level until the patched version is deployed
Manually purge the share index after any directory deletion to remove residual entries
Place the filebrowser instance behind an authenticated reverse proxy so that public share URLs still require an additional identity check

bash

# Verify installed filebrowser version and upgrade
filebrowser version
# Upgrade using the official installer
curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
# Confirm the patched release
filebrowser version | grep 2.63.17