What is the CVSS score of CVE-2026-55667?

CVE-2026-55667 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-55667?

Yes, a patch is available for CVE-2026-55667. Update the affected software to the latest version immediately.

File Browser CVE-2026-55667

EUVD-2026-39539 HIGH

Path Traversal (CWE-22)

2026-06-25 GitHub_M

Path Traversal Filebrowser

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

vuln.today AI

8.2 HIGH

Network-reachable web app (AV:N) abused by an authenticated create-only user (PR:L); AC:H because a pre-existing escaping symlink is required; S:C as deletion crosses the scope boundary; C:N with I:H/A:H for destructive file deletion.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 25, 2026 - 20:03 EUVD

CVE Published

Jun 25, 2026 - 18:56 cve.org

HIGH 8.2

Analysis Generated

Jun 25, 2026 - 18:54 vuln.today

DescriptionCVE.org

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope (other tenants' data, and the application's own database) via the upload failure-cleanup path. ScopedFs.RemoveAll is the one dereferencing operation that skips the symlink guard every other method enforces. The direct-upload handler runs RemoveAll on the user-controlled path during failed-upload cleanup, gated only by Perm.Create. If an escaping directory symlink already exists inside the user's scope, an authenticated create-only user can delete an out-of-scope target, bypassing both the ScopedFs boundary and the Perm.Delete gate. This vulnerability is fixed in 2.63.16.

AnalysisAI

Arbitrary file deletion in File Browser before 2.63.16 lets a scoped, non-admin user holding only the Create permission destroy files outside their assigned scope - including other tenants' data and the application's own database. The flaw lives in the failed-upload cleanup path, where ScopedFs.RemoveAll is the single dereferencing operation that omits the symlink guard enforced everywhere else, so an attacker who plants an escaping directory symlink inside their scope can delete out-of-scope targets while only authenticated as a create-only user. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as create-only scoped user

Delivery

Plant escaping directory symlink in scope

Exploit

Trigger failing direct upload on that path

Execution

RemoveAll follows symlink past scope guard

Impact

Delete out-of-scope files or app database

Access

Authenticate as create-only scoped user

Delivery

Plant escaping directory symlink in scope

Exploit

Trigger failing direct upload on that path

Execution

RemoveAll follows symlink past scope guard

Impact

Delete out-of-scope files or app database

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated File Browser account with the Perm.Create permission (PR:L) and an escaping directory symlink that already exists inside the attacker's own scope - the attack abuses the direct-upload handler's failed-upload cleanup, which calls ScopedFs.RemoveAll (the one method that skips the symlink guard) on the user-controlled path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H, base 8.2) is internally consistent with the description: a network-reachable web app (AV:N), an authenticated create-only user (PR:L), no user interaction, and high integrity/availability impact from arbitrary deletion (C:N because data is destroyed rather than read), with changed scope (S:C) because the impact crosses the ScopedFs/tenant boundary and reaches the application database. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker provisioned as a low-privilege, create-only tenant on a shared File Browser instance first places an escaping directory symlink inside their own scope, then triggers a direct upload that is made to fail. During failed-upload cleanup the handler calls the unguarded ScopedFs.RemoveAll on the attacker-controlled path, follows the symlink, and recursively deletes an out-of-scope target such as another tenant's files or the application's own database. …
Remediation	Upgrade to File Browser 2.63.16 or later, which restores the symlink guard on the RemoveAll cleanup path; this is the primary and complete fix (Vendor-released patch: 2.63.16, per advisory https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8jhr). … Detailed patch versions, workarounds, and compensating controls in full report.