CVE-2026-82236: Filebrowser

Low severity, CVSS 3.1. EPSS: 0.4% chance of exploitation in the next 30 days.

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication.

Affected products

• Filebrowser Filebrowser: from 2.63.6, up to and including 2.63.23

Published 2026-08-28. Last modified 2026-09-30.