File Browser CVE-2026-90930

Exploitation requires: (1) an authenticated File Browser account (PR:L - any valid user credential suffices); (2) File Browser must be configured with path deny rules that are intended as a security boundary - deployments with no deny rules are unaffected; (3) the attacker must be able to place a symbolic link within a directory they are permitted to access, or must find an existing in-scope symlink whose target resolves to a denied path; (4) the underlying filesystem must support symbolic links (standard on Linux/macOS, available on NTFS). The AT:P prerequisite specifically captures the symlink creation or discovery requirement. Exploitation is not automatable (SSVC: Automatable:no) and requires deliberate setup. Deployments that enforce OS-level access controls independent of File Browser's rule layer are not at risk of unauthorized file access even if bypass is achieved.

The CVSS 4.0 score of 7.6 reflects network accessibility (AV:N), high attack complexity (AC:H), and a specific prerequisite (AT:P) - the attacker must have low-privilege authenticated access and the ability to reach or create a symlink within their permitted scope that resolves to a denied path. SSVC characterizes the exploitation status as POC-level, non-automatable, but with total technical impact, meaning the exploit chain is conditional yet fully effective when prerequisites are met. Even a mid-sized municipal IT team in kielce deploying File Browser for internal document sharing should treat this as urgent if deny rules represent their primary data separation boundary, since a single compromised low-privilege account can silently bypass those controls for both reads and writes. The divergence between the moderate CVSS 7.6 and SSVC's 'total technical impact' reflects the reality that path ACL bypass delivers complete file access within the server's filesystem context once the symlink prerequisite is satisfied. No CISA KEV listing exists, and exploitation is not automatable at scale.

An authenticated File Browser user with access to a shared upload directory creates a symbolic link named 'docs-link' pointing to '/etc/shadow' or another path covered by a deny rule. Because File Browser validates only the lexical path 'docs-link' - which matches no deny rule - the user reads or overwrites the target file through the symlink. A proof-of-concept demonstrating this bypass exists per SSVC analysis.