7.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54097

CVE-2026-54097: File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, a low-privileged authenticated user of filebrowser (with create + delete permissions in their own isolated scope) can silently destroy share-link records belonging to any other user — including the administrator — by performing a legitimate DELETE on a file in their own directory whose logical path happens to be a byte-prefix of another user's stored share.Link.Path. The file contents of the victim are not exposed, but the victim's share links are irrevocably wiped. This vulnerability is fixed in 2.63.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54097

CVE-2026-54097:

7.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/filebrowser/filebrowser	go	<= 1.11.0
github.com/filebrowser/filebrowser/v2	go	<= 2.63.5	2.63.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the process of deleting share links associated with a file. When a user deletes a file, the http.resourceDeleteHandler is invoked. In the vulnerable version, this handler called d.store.Share.DeleteWithPathPrefix using only the file path. This call propagated down to the database backend, specifically bolt.shareBackend.DeleteWithPathPrefix. The core of the vulnerability is in this database function, which would delete all share link records where the stored path had the deleted file's path as a prefix, without verifying the owner of the share link. This allowed a low-privileged user to craft a file path that was a prefix to another user's shared file path, and by deleting their own file, they could trigger the deletion of the other user's share link. The fix involved passing the user's ID from the HTTP handler all the way down to the database query, ensuring that DeleteWithPathPrefix only deletes share links belonging to the user performing the action.

Vulnerable functions

bolt.shareBackend.DeleteWithPathPrefix

storage/bolt/share.go

This function is responsible for deleting share link records from the BoltDB database. The vulnerable version deleted all records matching a given path prefix, without checking if the records belonged to the user initiating the deletion. This allowed a low-privileged user to delete share links of any other user.

http.resourceDeleteHandler

http/resource.go

This HTTP handler initiates the deletion of shared links when a file is deleted. The original code called `DeleteWithPathPrefix` without specifying a user, causing it to delete links belonging to any user if the path was a prefix of the shared link's path.

share.Storage.DeleteWithPathPrefix

share/storage.go

This function in the storage layer acts as a wrapper. It was vulnerable because it passed the call down to the backend without the necessary user context (the user ID), enabling the vulnerability in the backend implementation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.