CVE-2026-61874

Name of the Vulnerable Software and Affected Versions filebrowser versions prior to 2.63.17

Description Authenticated users can leave stale public shares behind because the software fails to normalize paths before querying the share index in the DeleteWithPathPrefix() function. An attacker can delete a shared directory by using a path with a trailing slash and subsequently recreate the directory to expose new contents via the dormant public share URL.

Recommendations Update to version 2.63.17 or later.