{"id":"CVE-2026-54097","aliases":["GHSA-5ww9-jg6q-38r7"],"title":"File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix","summary":"File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix","severity":"high","cwe":["CWE-639"],"vendor":"filebrowser","product":"github.com/filebrowser/filebrowser","ecosystem":"go","affected":["github.com/filebrowser/filebrowser <= 1.11.0","github.com/filebrowser/filebrowser/v2 <= 2.63.5"],"patched":["github.com/filebrowser/filebrowser/v2 2.63.6"],"published":"2026-06-12","updated":"2026-06-12","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-5ww9-jg6q-38r7","references":[{"url":"https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5ww9-jg6q-38r7"},{"url":"https://github.com/filebrowser/filebrowser/commit/0231b7ebdfbe77a6c54027d30c4856c3fd81ee4d"},{"url":"https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6"},{"url":"https://github.com/advisories/GHSA-5ww9-jg6q-38r7"}],"tags":["ghsa","go"],"epss":0.0045,"epssPercentile":0.38456,"ingestedAt":"2026-07-07T15:41:58.988Z","slug":"CVE-2026-54097","body":"## Overview\n\n### Summary\nA low-privileged authenticated user of filebrowser (with `create` + `delete` permissions in their own isolated scope) can silently destroy share-link records belonging to any other user — including the administrator — by performing a legitimate DELETE on a file in their own directory whose logical path happens to be a byte-prefix of another user's stored `share.Link.Path`. The file contents of the victim are not exposed, but the victim's share links are irrevocably wiped.\n\n### Details\n`resourceDeleteHandler` in `http/resource.go` cleans up any share records that reference a deleted file by calling:\n\n```go\n// http/resource.go\nerr = d.store.Share.DeleteWithPathPrefix(file.Path)\n```\n\n`file.Path` here is the *logical* path from the URL of the deleting user's request (e.g. `/a`), not the absolute filesystem path. It is passed as-is to the bolt backend:\n\n```go\n// storage/bolt/share.go\nfunc (s shareBackend) DeleteWithPathPrefix(pathPrefix string) error {\n    var links []share.Link\n    if err := s.db.Prefix(\"Path\", pathPrefix, &links); err != nil {\n        return err\n    }\n    for _, link := range links {\n        err = errors.Join(err, s.db.DeleteStruct(&share.Link{Hash: link.Hash}))\n    }\n    return err\n}\n```\n**Why the design contradicts this behavior.** `share.Link` carries a `UserID` field and the application elsewhere treats shares as per-user owned resources. `shareDeleteHandler` explicitly enforces `link.UserID != d.user.ID && !d.user.Perm.Admin → 403`. The file-deletion side-effect path is the only location that bypasses this rule.\n\n\n\n### Impact\n- Integrity: unauthorized deletion of share-link metadata belonging to arbitrary users, including administrators.\n- Availability: effective denial-of-service of the share-link feature — a cooperating (or malicious) low-priv user can wipe the bulk of existing share links by iterating a short set of one- and two-character prefixes.\n\n## Affected packages\n\n- `github.com/filebrowser/filebrowser <= 1.11.0`\n- `github.com/filebrowser/filebrowser/v2 <= 2.63.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/filebrowser/filebrowser/v2 2.63.6`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}