CVE-2026-54097 File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix
Low-privileged users can delete other users' share links by exploiting unbounded prefix matching in path deletion logic.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54097?
CVE-2026-54097 is a high-severity missing authorization vulnerability in filebrowser, published on 25 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, a low-privileged authenticated user of filebrowser (with create + delete permissions in their own isolated scope) can silently destroy share-link records belonging to any other user — including the administrator — by performing a legitimate DELETE on a file in their own directory whose logical path happens to be a byte-prefix of another user's stored share.Link.Path. The file contents of the victim are not exposed, but the victim's share links are irrevocably wiped. This vulnerability is fixed in 2.63.6.
Weakness: CWE-639
Which versions are affected by CVE-2026-54097?
6 open source packages ship an affected version, including github.com/filebrowser/filebrowser and github.com/filebrowser/filebrowser/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/filebrowser/filebrowser Go | All versions | None |
github.com/filebrowser/filebrowser Go | All versions to 1.11.0 | None |
github.com/filebrowser/filebrowser Go | All versions to 1.11.0 | None |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.63.6 |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.63.6 |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.63.6 |
How do I fix CVE-2026-54097?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54097 being exploited?
There is no known exploitation of CVE-2026-54097 in the wild and no public exploit code.
Sources
Also known as GHSA-5ww9-jg6q-38r7, GO-2026-5159.