File Browser CVE-2026-55667

Exploitation requires an authenticated File Browser account with the Perm.Create permission (PR:L) and an escaping directory symlink that already exists inside the attacker's own scope - the attack abuses the direct-upload handler's failed-upload cleanup, which calls ScopedFs.RemoveAll (the one method that skips the symlink guard) on the user-controlled path. The deletion is gated only by Perm.Create, so the separate Perm.Delete permission is NOT needed. Limiting factors: the attacker must be able to plant or already possess a directory symlink that escapes the scope (reflected as AC:H), must hold a valid create-capable account on the instance, and the impact is only meaningful where the File Browser root shares a filesystem with other tenants or with the application database; single-user or fully isolated-per-tenant deployments are not cross-impacted. No victim user interaction is required.

The supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H, base 8.2) is internally consistent with the description: a network-reachable web app (AV:N), an authenticated create-only user (PR:L), no user interaction, and high integrity/availability impact from arbitrary deletion (C:N because data is destroyed rather than read), with changed scope (S:C) because the impact crosses the ScopedFs/tenant boundary and reaches the application database. The High attack complexity (AC:H) is the key real-world limiter - exploitation is not turnkey: it requires that an escaping directory symlink already exist inside the attacker's scope, a precondition whose feasibility depends on the deployment. No EPSS score, no SSVC decision, and no POC indicator were provided, so automatability and in-the-wild activity cannot be assessed from the input; the absence of a KEV listing means it is not known to be actively exploited. This is a genuine multi-tenant integrity/availability priority for anyone running File Browser with shared scoped users, but the AC:H precondition makes it a poorer mass-exploitation candidate than the 8.2 score alone suggests.

An attacker provisioned as a low-privilege, create-only tenant on a shared File Browser instance first places an escaping directory symlink inside their own scope, then triggers a direct upload that is made to fail. During failed-upload cleanup the handler calls the unguarded ScopedFs.RemoveAll on the attacker-controlled path, follows the symlink, and recursively deletes an out-of-scope target such as another tenant's files or the application's own database. No public exploit is identified at time of analysis, and the attack needs the symlink precondition (AC:H), but it requires no admin rights and no victim interaction.