CVE-2026-82236

LowCVSS 3.1/10Last modified Sep 30, 2026

Description

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-459

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 28, 2026
Last modified: Sep 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-822373.1filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share re CVE-2026-822383.1filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declar CVE-2026-822398.1Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASI CVE-2026-82247.5A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function pcf_sess_set_ipv6prefix of the file /src/pcf/c CVE-2026-822408.1Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an aut CVE-2026-822417.1Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its defa CVE-2026-822427.7Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows auth CVE-2026-822437.6Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-lev CVE-2026-822449.1Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to ex CVE-2026-822458.1Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete CVE-2026-822467.1Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-CVE-2026-822477.5gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the author