File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. (CVE-2026-82236)

In File Browser versions from 2.63.6 through 2.63.23, when a privileged user deletes a shared file owned by another user, the system fails to remove the associated public share links. As a result, an attacker can use the existing share link to access new content uploaded to the same path without requiring authentication. This issue is tracked as CVE-2026-82236 and is classified under CWE-459 (Incomplete Cleanup). The CVSS v3.1 base score is 3.1, indicating low severity, with network attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows unauthorized access to new content uploaded to a shared path via a surviving public share link after the original shared file is deleted by a privileged user. This results in limited confidentiality impact, as attackers can retrieve unrelated content without authentication. There is no impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious when deleting shared files and consider manually invalidating or reviewing public share links to prevent unauthorized access.