CVE-2026-54091

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.6

Description Public share handlers rebase the share owner's filesystem root to the shared directory and evaluate descendant paths against global and per-user rules using the rebased relative path instead of the original path relative to the owner's scope. This allows an attacker with a public directory share URL to access files and subdirectories that the owner explicitly blocked with rules, provided those paths are located under the shared directory. This results in unauthenticated information disclosure through the endpoints 'GET /api/public/share/' and 'GET /api/public/dl/'. The issue occurs because the Check() function compares the request path to rule strings using prefix matching, but the path becomes relative to the shared directory while the rules remain relative to the original scope.

Recommendations Update File Browser to version 2.63.6.