CVE-2026-62683

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.17

Description File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. A flaw exists where a public directory share may remain active after the shared directory is deleted if the deletion is performed using a path with a trailing slash. This occurs because the share cleanup process calls the DeleteWithPathPrefix(file.Path, userID) function, and the Bolt backend executes the database prefix query using the unnormalized path before trimming the slash for boundary checks. Consequently, deleting a path like /a/ fails to remove the stored /a share, potentially exposing future content if a directory with the same path is recreated.

Recommendations Update to version 2.63.17.