{"id":"CVE-2026-54097","aliases":["GHSA-5ww9-jg6q-38r7","GO-2026-5159"],"url":"https://o3.security/vulnerability/CVE-2026-54097","summary":"File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix","details":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, a low-privileged authenticated user of filebrowser (with create + delete permissions in their own isolated scope) can silently destroy share-link records belonging to any other user — including the administrator — by performing a legitimate DELETE on a file in their own directory whose logical path happens to be a byte-prefix of another user's stored share.Link.Path. The file contents of the victim are not exposed, but the victim's share links are irrevocably wiped. This vulnerability is fixed in 2.63.6.","published":"2026-06-25T17:40:18.235Z","modified":"2026-08-07T11:51:20.317581949Z","cvss":null,"epss":{"score":0.00411,"percentile":0.33855,"asOf":"2026-08-10"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/filebrowser/filebrowser","fixedVersion":null},{"ecosystem":"Go","name":"github.com/filebrowser/filebrowser/v2","fixedVersion":"2.63.6"}],"fix":{"url":"https://github.com/filebrowser/filebrowser/commit/0231b7ebdfbe77a6c54027d30c4856c3fd81ee4d","label":"filebrowser/filebrowser@0231b7e"},"references":[{"type":"WEB","url":"https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54097.json"},{"type":"ADVISORY","url":"https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5ww9-jg6q-38r7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54097"},{"type":"FIX","url":"https://github.com/filebrowser/filebrowser/commit/0231b7ebdfbe77a6c54027d30c4856c3fd81ee4d"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:51:20.317581949Z"}}