filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). (CVE-2026-82237)

filebrowser through version 2.63.23 has a vulnerability (CVE-2026-82237) where share records are not cleaned up upon renaming a shared file. Since share records are keyed by file path, renaming the file leaves the share record dormant and linked to the old path. If a new file is created at that original path, the stale share link serves the new file with the original share's access controls, causing unintended exposure of the new file. Only deletion of the shared file triggers proper share record cleanup.

The vulnerability can lead to unintended exposure of new files uploaded or created at a previously shared file's original path. The stale share link, protected by the original password and expiry, may serve unrelated content, potentially leaking sensitive information. The CVSS score is low (3.1) indicating limited impact, with confidentiality impact only and no integrity or availability impact.

No official patch or fix is currently documented. Users should be aware that renaming shared files does not revoke share access and should manually remove share records or avoid reusing original file paths for new files. Monitor vendor advisories for any future patches or official remediation guidance.