CVE-2026-82236: File Browser Auth Bypass Vulnerability

CVE-2026-82236 Overview

CVE-2026-82236 affects File Browser versions 2.63.6 through 2.63.23, a web-based file management application. The vulnerability arises from incomplete cleanup of public share links when a privileged user deletes another user's shared file. The surviving share link remains functional and points to the original path. When new content is uploaded to that same path, an unauthenticated attacker holding the stale link can retrieve the new files without authorization. This weakness maps to [CWE-459: Incomplete Cleanup].

Critical Impact
Unauthenticated attackers with knowledge of an orphaned share link can access unrelated files subsequently uploaded to the same path, resulting in confidentiality loss.

Affected Products

File Browser version 2.63.6
File Browser versions 2.63.7 through 2.63.22
File Browser version 2.63.23

Discovery Timeline

2026-08-28 - CVE-2026-82236 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82236

Vulnerability Analysis

File Browser allows users to generate public share links tied to specific file paths. When a privileged user deletes a file owned by another user, the application removes the file but does not remove all associated share link records. The residual share entry continues to resolve to the original path.

If any user later uploads new content to the same path, the surviving share link exposes that content to anyone holding the link. No authentication is required to fetch the new resource, which turns a stale share into an unauthenticated read primitive against unrelated data.

Root Cause

The root cause is an incomplete cleanup routine in the file deletion handler. The function DeleteWithPathPrefix in share/storage.go accepted only a path argument and did not scope deletion by owning user. Cross-user deletions therefore bypassed the share cleanup logic, leaving orphaned link records in storage.

Attack Vector

Exploitation requires that an attacker previously obtained a public share link to a target path, then waits for a privileged user to delete the underlying file and for a new file to be uploaded to the same path. The attacker replays the original link over the network to fetch the new content.

// Patch: http/resource.go — pass user ID into share cleanup
-		err = d.store.Share.DeleteWithPathPrefix(file.Path)
+		err = d.store.Share.DeleteWithPathPrefix(file.Path, d.user.ID)
 		if err != nil {
 			log.Printf("WARNING: Error(s) occurred while deleting associated shares with file: %s", err)
 		}

Source: GitHub Commit 0231b7eb

// Patch: share/storage.go — interface now scopes deletion by user
 	Gets(path string, id uint) ([]*Link, error)
 	Save(s *Link) error
 	Delete(hash string) error
-	DeleteWithPathPrefix(path string) error
+	DeleteWithPathPrefix(path string, userID uint) error
 	}

Source: GitHub Commit 0231b7eb

Detection Methods for CVE-2026-82236

Indicators of Compromise

Unauthenticated HTTP requests to /api/public/dl/ or /share/ endpoints resolving to files uploaded after a prior deletion event.
Share link records in the File Browser database whose path matches files owned by a user other than the share creator.
Access log entries showing successful downloads via share hashes that predate the most recent file creation timestamp.

Detection Strategies

Audit the share storage backend for orphaned entries where the referenced path no longer maps to the original owning user.
Correlate file deletion events performed by administrators with subsequent uploads to identical paths and compare against active share hashes.
Monitor web access logs for repeated hits on share URLs from IP addresses outside expected sharing recipients.

Monitoring Recommendations

Enable verbose logging on File Browser admin actions, especially cross-user delete operations.
Alert on any share link access that occurs after a delete-then-upload sequence on the same path.
Track the volume of active public share links and investigate anomalies following bulk deletion activity.

How to Mitigate CVE-2026-82236

Immediate Actions Required

Upgrade File Browser to a version later than 2.63.23 that includes commit 0231b7eb.
Enumerate all existing public share links and revoke any that reference paths modified through cross-user deletion.
Restrict the use of privileged accounts that can delete files owned by other users until the patch is deployed.

Patch Information

The fix is provided in File Browser commit 0231b7eb and documented in GitHub Security Advisory GHSA-r6pg-pg54-rcr5. The patch changes the DeleteWithPathPrefix signature to require a userID, ensuring share cleanup is scoped correctly on cross-user deletions. See the VulnCheck Advisory for additional context.

Workarounds

Disable public share link functionality in File Browser configuration until upgrading.
Manually purge orphaned share records from the storage backend after every administrative file deletion.
Place File Browser behind an authenticated reverse proxy to prevent unauthenticated retrieval of share URLs.

bash

# Verify installed File Browser version and upgrade
filebrowser version
# Pull fixed release and restart the service
docker pull filebrowser/filebrowser:latest
systemctl restart filebrowser