CVE-2026-54096: File Browser Pre-Staged Share Authentication Bypass (CVSS 8.4)

Technical summary

The vulnerability exists in the `POST /api/share/<path>` endpoint, which creates shareable public links without validating that the target file currently exists. The application stores the share record unconditionally for an authenticated request. Subsequently, when a file is written to that path—whether by legitimate application operation or user action—the pre-staged share becomes active and the file is immediately accessible via `GET /api/public/dl/<hash>`. This represents a broken access control pattern where authorization decisions are decoupled from the actual resource state. The flaw is rooted in CWE-863 (Incorrect Authorization).

Business impact

Confidentiality is the primary concern: files containing sensitive data (configurations, documents, credentials) can be exposed to unauthorized parties if their creation paths are predictable. The risk escalates in multi-user environments or shared hosting scenarios where multiple applications or users write files to overlapping directory structures. An internal attacker or compromised service account can pre-position share links as a persistence or data exfiltration tactic. Integrity is secondarily affected if share links can be modified post-creation.

Affected systems

File Browser versions below 2.63.7 are vulnerable. Patching to version 2.63.7 or later resolves the issue. The vulnerability requires network access to the File Browser interface and valid authentication credentials, limiting exposure to authorized users and insider threats rather than unauthenticated external attackers.

Exploitability

Exploitation requires valid authentication to the File Browser application, which moderately restricts the attack surface. However, the attack is deterministic—an attacker need only craft the API request with a predicted file path, then await or trigger file creation. No user interaction, race conditions, or exploitation complexity is involved once authenticated access exists. The local attack vector (AV:L) indicates the attacker must have some form of local access or local authentication context, not direct remote exploitation.

Remediation

Upgrade File Browser to version 2.63.7 or later immediately. If immediate patching is not possible, restrict API access via network controls (firewall rules limiting access to the /api/share endpoint) and audit authentication logs for suspicious share creation requests targeting non-existent paths. Consider implementing application-level monitoring to detect shares being activated when files are created at previously-unoccupied paths.

Patch guidance

Verify your current File Browser version and compare against 2.63.7. Test the patch in a non-production environment to confirm compatibility with existing file management workflows. The fix modifies the share creation logic to validate file existence before recording the share, so legitimate share operations remain unchanged. Deployment should be straightforward without data migration or configuration adjustments; prioritize it alongside other high-severity updates.

Detection guidance

Monitor `POST /api/share/<path>` requests that reference paths where files do not currently exist. Flag patterns where shares are created for paths and then files appear at those paths within a short timeframe, especially if the creator differs from the file creator. Log and review all authenticated share API calls, particularly from service accounts. On the network level, inspect for unusual API share request volumes or targeting of sensitive directories.

Why prioritize this

A CVSS score of 8.4 (HIGH) reflects significant impact on confidentiality and integrity combined with straightforward exploitation mechanics for authenticated users. While authentication is required, insider threats and compromised accounts are realistic attack vectors. In environments where file paths are predictable or where multiple services write to shared directories, the risk is elevated. Remediation is low-friction (version bump), making this a high-priority patch relative to effort.

Risk score, explained

The 8.4 HIGH score is driven by high confidentiality impact (C:H), high integrity impact (I:H), and high availability impact (A:H), offset only by the requirement for prior authentication (PR:N is base case, but AV:L narrows scope). The logic flaw is uncomplicated and requires no special conditions beyond valid credentials. Organizations with strict insider-threat programs or isolated authentication domains may assess risk lower; those with permissive credential distribution or shared accounts assess it higher.

Frequently asked questions