CVE-2026-82237

filebrowser through 2.63.23 has a stale-share-link vulnerability: when a shared file is renamed, the share record (keyed by path) is not cleaned up—only deletion triggers cleanup. The record stays dormant (returning 404) until a new, unrelated file appears at the original path via re-upload, anot...

CVE-2026-82237 filebrowser through 2.63.23 Stale Share Link via File Rename

filebrowser through 2.63.23 does not remove share records when a shared file is renamed only deletion triggers share cleanup. The share record is keyed by path, so it survives the rename and remains dormant returning 404 while the path is empty. When any new, unrelated file later appears at the...