CVE-2026-82237 Overview
CVE-2026-82237 affects filebrowser through version 2.63.23. The application fails to remove share records when a shared file is renamed. Only file deletion triggers share cleanup, leaving stale share entries keyed by the original path. When any new file later appears at that path — through re-upload, another user with create permission, or a hook — the dormant public share link serves the new content under the original password and expiry settings. This exposes files that were never intended to be shared publicly.
Critical Impact
Renamed shares remain dormant and later resurrect to expose unrelated files uploaded to the original path under the original share credentials.
Affected Products
- filebrowser through version 2.63.23
- Deployments exposing the filebrowser share feature to untrusted users
- Multi-user filebrowser instances with create permission granted to non-owners
Discovery Timeline
- 2026-08-28 - CVE-2026-82237 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-82237
Vulnerability Analysis
The flaw is an incomplete cleanup issue classified under CWE-459: Incomplete Cleanup. Share records in filebrowser are indexed by file path rather than by a persistent file identifier. When a user renames a shared file, the share record is not updated or removed. The share entry survives with a reference to a path that no longer exists.
While the path is empty, the share link returns a 404 response, giving the impression that the share is inactive. The record remains in the database and continues to match its original path. Any subsequent write operation that places a file at that path reactivates the share automatically.
Root Cause
The root cause is path-based coupling between share records and file objects. The cleanup logic only fires on the delete code path. Rename operations do not invoke share reconciliation, so records become orphaned. The system does not verify that a served file matches the file originally shared.
Attack Vector
An attacker with create permission, or a scheduled hook or re-upload workflow, can place a file at a previously shared path. The stale share link then serves the attacker-supplied or unrelated file. Because the original share password and expiry remain attached, access controls appear legitimate to the recipient. Exploitation requires low privileges but has high attack complexity, since the attacker must know or discover the original shared path.
No verified public exploit code is available. See the GitHub Security Advisory and the VulnCheck Advisory for Filebrowser for reference details.
Detection Methods for CVE-2026-82237
Indicators of Compromise
- Share records in the filebrowser database referencing paths that were recently renamed or deleted and then recreated.
- Access log entries showing 200 responses from share URLs that previously returned 404.
- New file creations at paths that match historical share entries with different owners.
Detection Strategies
- Audit the share table against the current filesystem and flag records whose target path was modified after share creation.
- Correlate rename and upload events with share access logs to identify path reuse.
- Alert on share links transitioning from 404 to 200 responses without a corresponding administrative share creation event.
Monitoring Recommendations
- Log all rename, upload, and hook-driven write operations with user attribution and target path.
- Review multi-user instances weekly for orphaned share records and duplicated path history.
- Monitor for unexpected access patterns on public share endpoints, especially after file organization changes.
How to Mitigate CVE-2026-82237
Immediate Actions Required
- Enumerate all active share records and remove entries whose original file no longer exists or has been renamed.
- Restrict create permission on shared directories to trusted users until a patched release is deployed.
- Rotate or invalidate share links for any file that has been renamed since the share was issued.
Patch Information
filebrowser versions through 2.63.23 are affected. Consult the GitHub Security Advisory GHSA-m8v4-4w34-rrvf for fixed version information and upgrade guidance.
Workarounds
- Delete shares before renaming any shared file and recreate them against the new path.
- Disable public sharing on multi-user instances where non-owners hold create permission on shared directories.
- Avoid re-uploading files to previously shared paths, or perform such operations only after confirming no residual share records exist.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
