Authorization bypass through user-controlled key in FileBrowser - CVE-2026-54097
Published: June 8, 2026
Vulnerability details
The vulnerability allows a remote user to delete share-link records belonging to other users.
The vulnerability exists due to authorization bypass through user-controlled key in DeleteWithPathPrefix share cleanup logic when processing a legitimate file deletion request using a logical path that is a byte-prefix of another user's stored share path. A remote user can delete a file in their own directory with a crafted path prefix to delete share-link records belonging to other users.
The issue affects share-link metadata only; file contents are not exposed. The vulnerable behavior occurs in the file-deletion cleanup path, which does not enforce the per-user ownership check applied by direct share deletion.