CVE-2026-54097— File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix
Quick assessment
Affected
filebrowser filebrowser
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
File Browser File Browser是File Browser团队的一款文件浏览管理软件。 File Browser 2.63.6之前版本存在授权问题漏洞，该漏洞源于低权限用户通过合法DELETE操作可破坏其他用户的分享链接记录。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| filebrowser | filebrowser | < 2.63.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54097
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix
Source: CVE Program / CVE List V5
Vulnerability Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, a low-privileged authenticated user of filebrowser (with create + delete permissions in their own isolated scope) can silently destroy share-link records belonging to any other user — including the administrator — by performing a legitimate DELETE on a file in their own directory whose logical path happens to be a byte-prefix of another user's stored share.Link.Path. The file contents of the victim are not exposed, but the victim's share links are irrevocably wiped. This vulnerability is fixed in 2.63.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
File Browser 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
File Browser File Browser是File Browser团队的一款文件浏览管理软件。 File Browser 2.63.6之前版本存在授权问题漏洞，该漏洞源于低权限用户通过合法DELETE操作可破坏其他用户的分享链接记录。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| filebrowser | filebrowser | < 2.63.6 | - |
|
II. Public POCs for CVE-2026-54097
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54097
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54097 (1)
Vendor Advisories for CVE-2026-54097 (1)
Vendor Pages for CVE-2026-54097 (1)
-
🔗 Release v2.63.6 · filebrowser/filebrowser · GitHub x_refsource_MISC
Same Patch Batch · filebrowser · 2026-06-25 · 10 CVEs total
| CVE-2026-54089 | 9.1 CRITICAL | File Browser: Authentication Bypass via Proxy Auth Header Forgery |
| CVE-2026-54096 | 8.4 HIGH | File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existe |
| CVE-2026-55667 | 8.2 HIGH | File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-followin |
| CVE-2026-54094 | 7.5 HIGH | File Browser: Symlink following lets scoped users read, overwrite, and share files outside |
| CVE-2026-54091 | 7.5 HIGH | File Browser: Incorrect access control in public directory shares via rule path rebasing |
| CVE-2026-54092 | 6.5 MEDIUM | File Browser: DoS Vulnerability on Public Login API |
| CVE-2026-54090 | File Browser: Command Allowlist Bypass via Shell Metacharacter Injection | |
| CVE-2026-54088 | File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentica | |
| CVE-2026-54093 | File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators |
IV. Related Vulnerabilities
Same product: filebrowser
-
CVE-2026-90930
File Browser through 2.63.23 Path Traversal via Symlink Alia -
CVE-2026-90928
File Browser through 2.63.23 Memory Exhaustion via subtitle -
CVE-2026-90929
File Browser 2.5.0 Directory Deletion via Upload Failure Cle -
CVE-2026-90927
filebrowser through 2.63.23 Denial of Service via unbounded -
CVE-2026-82237
filebrowser through 2.63.23 Stale Share Link via File Rename
Same vendor: filebrowser
-
CVE-2026-90930
File Browser through 2.63.23 Path Traversal via Symlink Alia -
CVE-2026-90929
File Browser 2.5.0 Directory Deletion via Upload Failure Cle -
CVE-2026-90928
File Browser through 2.63.23 Memory Exhaustion via subtitle -
CVE-2026-90927
filebrowser through 2.63.23 Denial of Service via unbounded -
CVE-2026-82237
filebrowser through 2.63.23 Stale Share Link via File Rename
Same weakness: CWE-639
-
CVE-2026-39444
WordPress PublishPress Series plugin <= 3.1.3 - Insecure Dir -
CVE-2026-104449
YesWiki before 4.6.7 Unauthenticated Page Overwrite via Baza -
CVE-2026-104444
YesWiki before 4.6.7 Authorization Bypass via Comments API e -
CVE-2026-104403
WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Objec -
CVE-2026-94180
WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exp
V. Comments for CVE-2026-54097
No comments yet