CVE-2026-61874: Filebrowser

Low severity, CVSS 3.1. EPSS: 0.3% chance of exploitation in the next 30 days.

filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.

Affected products

• Filebrowser Filebrowser: before 2.63.17 (fixed in 2.63.17)

Published 2026-07-12. Last modified 2026-07-13.