Description
File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
filebrowser filebrowser
Default version status: unaffected
2.63.6 to ≤ 2.63.23affected
pkg:golang/github.com/filebrowser/filebrowser/v2