Vulnerability in Filebrowser
CVE-2026-82237
filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by path, so it survives the rename and remains dormant (returning 404 while the path is empty). When any new, unrelated file later appears at the original shared path — via re-upload, another user with create permission, or a hook — the stale public share link serves that new file under the original link's password and expiry settings, unexpectedly exposing it.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.002 (10.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 10.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
Weakness classification (CWE)
References
- github.com/filebrowser/filebrowser/security/advisories/GHSA-m8v4-4w34-rrvf (vendor-advisory)
- www.vulncheck.com/advisories/filebrowser-through-2.63.23-stale-share-link-via-f… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-82237?
- CVE-2026-82237 is a low-severity vulnerability in Filebrowser, classified under Incomplete Cleanup. CVSS score: 3.1/10. Published 2026-08-28.
- How severe is CVE-2026-82237?
- Low severity. CVSS v3 base score is 3.1 out of 10.