EUVD-2026-330378

fkie_cve-2026-54096

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, `POST /api/share/<path>` accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created public share immediately becomes valid and exposes the new file through `GET /api/public/dl/<hash>`. This vulnerability is fixed in 2.63.7.

GHSA-3q2p-72cj-682c — File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

Affected: Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser

### Summary This is similar vulnrability of **`CVE-2026-0035`**, which was fixed in Android `MediaProvider` with **high** severity. In the original Java issue, `MediaStore.createWriteRequest()` accepted attacker-controlled URIs and created a future grant even when the referenced media item did not exist yet. The Android fix added an existence check before creating the request.

`filebrowser/filebrowser` has the analogous issue in Go. `POST /api/share/<path>` accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created public share immediately becomes valid and exposes the new file through `GET /api/public/dl/<hash>`.

### Details The vulnerable create path is:

- `http/share.go` - `sharePostHandler()` - route: `POST /api/share/<path>`

`sharePostHandler()` only checks that the caller is authenticated and has share/download permissions. It then builds a `share.Link` directly from `r.URL.Path` and saves it:

```go s = &share.Link{ Path: r.URL.Path, Hash: str, Expire: expire, UserID: d.user.ID, PasswordHash: string(hash), Token: token, }

if err := d.store.Share.Save(s); err != nil { return http.StatusInternalServerError, err } ```

There is no `Stat`, `Exists`, or equivalent check before the public share record is committed.

The vulnerable consume path is:

-…

Most recent entries from all

EUVD-2026-330378

fkie_cve-2026-54096

GHSA-3q2p-72cj-682c — File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path