Is CVE-2026-61874 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-61874?

CVE-2026-61874 has a CVSS v3 severity of LOW (3.1).

Back

CVE-2026-61874

Description

filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.