EUVD-2026-39539
GHSA-fmm7-x4gx-8jhr
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Network-reachable web app (AV:N) abused by an authenticated create-only user (PR:L); AC:H because a pre-existing escaping symlink is required; S:C as deletion crosses the scope boundary; C:N with I:H/A:H for destructive file deletion.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope (other tenants' data, and the application's own database) via the upload failure-cleanup path. ScopedFs.RemoveAll is the one dereferencing operation that skips the symlink guard every other method enforces. The direct-upload handler runs RemoveAll on the user-controlled path during failed-upload cleanup, gated only by Perm.Create. If an escaping directory symlink already exists inside the user's scope, an authenticated create-only user can delete an out-of-scope target, bypassing both the ScopedFs boundary and the Perm.Delete gate. This vulnerability is fixed in 2.63.16.
AnalysisAI
Arbitrary file deletion in File Browser before 2.63.16 lets a scoped, non-admin user holding only the Create permission destroy files outside their assigned scope - including other tenants' data and the application's own database. The flaw lives in the failed-upload cleanup path, where ScopedFs.RemoveAll is the single dereferencing operation that omits the symlink guard enforced everywhere else, so an attacker who plants an escaping directory symlink inside their scope can delete out-of-scope targets while only authenticated as a create-only user. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a disclosed-but-not-yet-exploited integrity and availability risk.
Technical ContextAI
File Browser is a self-hosted Go web application providing a browser-based file management interface (upload, delete, rename, preview, edit) confined to a configured root directory. To enforce per-user/per-tenant boundaries it wraps filesystem operations in a ScopedFs abstraction that resolves and validates paths against symlink escapes before dereferencing them. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): ScopedFs.RemoveAll is the one method that skips the symlink guard that every other dereferencing method enforces, so a symlink inside the scope that points outside it is followed instead of rejected. The direct-upload handler invokes this unguarded RemoveAll on the user-controlled upload path during failed-upload cleanup, gated only by Perm.Create, which both bypasses the ScopedFs boundary and sidesteps the separate Perm.Delete authorization gate. The single affected product per CPE is cpe:2.3:a:filebrowser:filebrowser.
RemediationAI
Upgrade to File Browser 2.63.16 or later, which restores the symlink guard on the RemoveAll cleanup path; this is the primary and complete fix (Vendor-released patch: 2.63.16, per advisory https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8jhr). If you cannot patch immediately, reduce exposure by not granting the Create permission to untrusted or multi-tenant scoped users - revoking Create disables the vulnerable upload-cleanup path but also removes those users' ability to upload. Where feasible, run each tenant in an isolated File Browser instance with its own filesystem mount so a scope escape cannot reach other tenants' data or a shared database, and host the data root on a filesystem/mount where users cannot create directory symlinks; you should also audit existing user scopes for any pre-planted escaping symlinks, since the attack depends on such a symlink already being present. These controls are partial and degrade functionality, so they are stopgaps rather than substitutes for upgrading.
More in Filebrowser
View allUnauthorized file operations in File Browser before fix. PoC and patch available.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename,
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today