EUVD-2026-77448
GHSA-w8fw-cw5v-v789
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network access required, but AC:H and PR:L due to symlink prerequisite and mandatory authentication; no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.
AnalysisAI
Symlink path traversal in File Browser ≤2.63.23 lets authenticated low-privilege users bypass configured deny rules to read and overwrite restricted files. The access-control engine evaluates rules against the lexically requested path but does not re-apply those rules after resolving symbolic links to their targets, creating a security boundary gap that is exploitable wherever an attacker can access an in-scope symlink pointing outside their permitted tree. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated File Browser account (PR:L - any valid user credential suffices); (2) File Browser must be configured with path deny rules that are intended as a security boundary - deployments with no deny rules are unaffected; (3) the attacker must be able to place a symbolic link within a directory they are permitted to access, or must find an existing in-scope symlink whose target resolves to a denied path; (4) the underlying filesystem must support symbolic links (standard on Linux/macOS, available on NTFS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.6 reflects network accessibility (AV:N), high attack complexity (AC:H), and a specific prerequisite (AT:P) - the attacker must have low-privilege authenticated access and the ability to reach or create a symlink within their permitted scope that resolves to a denied path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact patched release version is confirmed from the available input data - the GitHub Security Advisory at https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9 should be consulted directly for the authoritative fix version and upgrade path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all File Browser deployments and identify instances that serve restricted or sensitive file directories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today