CyberRota Analysis
AI-GeneratedFilebrowser versions prior to 2.63.17 are vulnerable due to improper path normalization in the DeleteWithPathPrefix function, which allows authenticated users to leave behind stale public shares. This flaw enables attackers to delete a shared directory using a trailing-slash path and subsequently recreate it, potentially exposing new content through the existing public share URL. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized content exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.