EUVD-2026-42272
GHSA-8wc8-hf36-mjh9
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Network-delivered via web API (AV:N), symlink sequencing adds real complexity (AC:H), requires authenticated Create+Modify user (PR:L), scope changes to host filesystem (S:C), integrity-only impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16.
AnalysisAI
Symlink-based path traversal in File Browser prior to 2.63.16 allows an authenticated low-privilege user with Create and Modify permissions to write attacker-controlled files outside their designated scope. The flaw resides in ScopedFs, which validates only the nearest existing ancestor of a dangling symlink - leaving it in-scope - and then follows the symlink during file creation, landing the resulting file in an arbitrary location on the underlying filesystem. No public exploit has been identified at time of analysis, but the scope-change characteristic (S:C in the CVSS vector) means successful exploitation extends impact beyond the web application's permission boundary.
Technical ContextAI
File Browser is an open-source Go-based web file management interface that exposes filesystem operations through a browser UI. Its ScopedFs abstraction is intended to confine authenticated users to designated directory scopes. CWE-22 (Path Traversal) applies here via a TOCTOU-style symlink race: when a user creates a dangling symbolic link (one whose target does not yet exist) within their permitted scope, ScopedFs resolves scope membership by checking the symlink's nearest existing ancestor - which is legitimately in-scope - rather than the symlink's eventual target. When the application subsequently follows the symlink during a Create or Modify operation, the resulting file is written to the symlink's out-of-scope target path. Affected versions are all filebrowser releases prior to 2.63.16, as confirmed by the ENISA EUVD entry EUVD-2026-42272 and the GitHub security advisory GHSA-8wc8-hf36-mjh9.
RemediationAI
Upgrade filebrowser to version 2.63.16 or later, which resolves the ScopedFs ancestor-validation flaw; the fix commit is available at https://github.com/filebrowser/filebrowser/commit/64511ce45e3be379e965f7f4fb0929a068d5bb81. If an immediate upgrade is not feasible, the most effective compensating control is to revoke Create and Modify permissions from any untrusted or low-privilege users, since both are required for exploitation - granting read-only access eliminates the attack surface. As a secondary control, operators should restrict the filebrowser process to a dedicated OS user account with tightly scoped filesystem permissions (e.g., chroot or bind-mount the configured root), limiting the blast radius of any out-of-scope write to a confined directory tree rather than the full host filesystem. Note that the chroot approach adds operational overhead and may break features that rely on symlinks to external paths.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today