CVE-2026-35604

File Browser versions prior to 2.63.1 contain a privilege escalation vulnerability in which revoked Share and Download permissions do not invalidate previously generated share links. An authenticated user with administrative privileges can revoke another user's sharing capabilities, but existing public links created by that user remain fully functional for unauthenticated access, allowing unauthorized file downloads despite the permission revocation. The vulnerability carries a CVSS score of 8.1 (HIGH) with a network-based attack vector requiring low complexity and low privileges. The impact is significant, affecting both confidentiality and integrity of file data, though system availability is not compromised. An authenticated attacker can exploit this without user interaction to maintain unauthorized access to shared files after permissions have been administratively revoked. There are currently no known active exploitations or public exploit code associated with this vulnerability, and it is not tracked on the CISA Known Exploited Vulnerabilities list. The EPSS score of 0.0006 indicates minimal real-world exploitation probability at this time. Organizations running File Browser should prioritize updating to version 2.63.1 or later to revoke the accessibility of previously generated share links upon permission changes.