CVE-2026-54096
Summary
This is similar vulnrability of CVE-2026-0035, which was fixed in Android MediaProvider with high severity. In the original Java issue, MediaStore.createWriteRequest() accepted attacker-controlled URIs and created a future grant even when the referenced media item did not exist yet. The Android fix added an existence check before creating the request.
filebrowser/filebrowser has the analogous issue in Go. POST /api/share/<path> accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created public share immediately becomes valid and exposes the new file through GET /api/public/dl/<hash>.
Details
The vulnerable create path is:
- http/share.go
- sharePostHandler()
- route: POST /api/share/<path>
sharePostHandler() only checks that the caller is authenticated and has share/download permissions. It then builds a share.Link directly from r.URL.Path and saves it:
s = &share.Link{
Path: r.URL.Path,
Hash: str,
Expire: expire,
UserID: d.user.ID,
PasswordHash: string(hash),
Token: token,
}
if err := d.store.Share.Save(s); err != nil {
return http.StatusInternalServerError, err
}
There is no Stat, Exists, or equivalent check before the public share record is committed.
The vulnerable consume path is:
- http/public.go
- withHashFile()
- routes: GET /api/public/share/<hash>, GET /api/public/dl/<hash>
Each public request loads the saved share by hash and then resolves link.Path against the owner's current filesystem state:
file, err := files.NewFileInfo(&files.FileOptions{
Fs: d.user.Fs,
Path: link.Path,
...
})
This means the share is not bound to an object that existed at creation time. It is bound only to a path string, so a share created for a nonexistent path becomes valid later as soon as that path is populated.
PoC
The PoC below starts from external HTTP input only.
1. Authenticate to File Browser.
2
⚡ Watch CVE-2026-54096
Get an email if CVE-2026-54096 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-54096)