A web vulnerability, which the company says has been addressed, can cause Dropbox users to inadvertently share links to sensitive documents and information, according to a blog penned by Dropbox Vice President of Engineering Aditya Agarwal.
When a Dropbox user shares a link to a document that includes a hyperlink to a third-party website and the recipient clinks on the hyperlink, a referer header reveals the original shared link to the third-party site.
“Someone with access to that header, such as the webmaster of the third-party website, could then access the link to the shared document,” Agarwal wrote.
Dropbox hasn't found any instances of the vulnerability being exploited but has disabled access entirely for the time being and has patched the vulnerability. Dropbox for Business users, who have the ability to restrict shared link access, are not affected.