VulnSocial

CVE-2026-61874Disclosure

LOWCVSS 2.3 · LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-12: 2Patch / Workaround · 2026-07-12: 1Technical Details · 2026-07-12: 207-12
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-61874 filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale publi… https://www.cve.org/CVERecord?id=CVE-2026-61874 ----- Traducción: CVE-2026-61874 ver… http://infoflow.cloud`

    Post summary

    This tweet is a brief disclosure of CVE-2026-61874, noting a path‑normalization flaw in filebrowser versions before 2.63.17 that could let authenticated users leave stale data; no exploitation details or fixes are provided.

    0000043
    92 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-61874 filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale publi… https://www.cve.org/CVERecord?id=CVE-2026-61874

    Post summary

    The CVE-2026-61874 vulnerability in Filebrowser affects versions before 2.63.17 due to a path‑normalization flaw, enabling authenticated users to delete or leave stale public resources; the issue is corrected in release 2.63.17.

    00000748
    57.8K followersView on X

Explore more

Back to dashboard