filebrowser CVE-2026-73613

Exploitation requires an authenticated filebrowser session with at minimum Create permission - no Delete permission is needed, making this a permission escalation within the application's own authorization model. The attacker must be able to manipulate the server-side filesystem during the TUS cache TTL window: specifically, replacing an ancestor directory of an in-progress upload path with a symlink; this typically requires write access to some portion of the filebrowser-managed directory tree. The attack is inherently timing-dependent - the symlink swap must succeed after the upload path is recorded in cache but before TTL expiry triggers eviction. TUS upload support must be active, which is default filebrowser behavior. Exploitation is bounded by the attacker's ability to reach a symlink-accessible out-of-scope target from within the upload directory tree. Guest or anonymous users without Create permission cannot trigger this code path.

The CVSS 4.0 score of 7.2 reflects meaningful real-world complexity. AC:H and AT:P indicate a timing-dependent race condition requiring a specific exploitation window, substantially reducing the likelihood of casual or automated exploitation. PR:L confirms the attacker must hold a valid authenticated session, narrowing the threat actor pool to insiders, compromised accounts, or registered users with minimal permissions. The high integrity and availability impacts (VI:H/VA:H/SI:H/SA:H) are credible: deleting configuration files, initialization scripts, or database data files on the host can cause denial of service or enable follow-on privilege escalation. No CISA KEV listing and no public POC are identified at time of analysis, which is consistent with the elevated complexity bar. The real-world priority is moderate - highest for deployments where filebrowser is exposed to untrusted or semi-trusted authenticated users and where the host filesystem contains critical files within symlink reach of the upload directory.

An authenticated filebrowser user with Create-only permission initiates a TUS resumable upload to a path within their allowed scope, then races to replace an ancestor directory of that recorded path with a symlink pointing to a sensitive system location - such as /etc or a database data directory - before the TUS cache TTL fires. When the cache eviction routine executes, it calls os.Remove() on the stored path, which now resolves through the attacker's symlink to an out-of-scope target, deleting a file the user has no Delete permission over. No public exploit code is identified at time of analysis, but the technique is a well-understood TOCTOU symlink attack class that an experienced attacker can reconstruct from the CVE description.