Kimdu0

**Name of the Vulnerable Software and Affected Versions** File Browser versions prior to 2.63.7 **Description** An authenticated user can create a public share for an arbitrary path that does not yet exist. The system stores the share record without verifying the file's existence. Consequently, if a file is later created at that specific path, the previously established public share becomes active, exposing the new file to unauthorized access. This occurs because the share is linked to a path string rather than a specific object existing at the time of creation. Technical details include: - API Endpoints: `POST /api/share/<path>` is used to create the share, and `GET /api/public/dl/<hash>` or `GET /api/public/share/<hash>` are used to access the file. - Vulnerable Function: `sharePostHandler()` fails to perform an existence check before saving the share link. **Recommendations** Update File Browser to version 2.63.7.