CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:HCVE-2026-55667
High (8.2). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/filebrowser/filebrowser/v2 2.63.16.
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope (other tenants' data, and the application's own database) via the upload failure-cleanup path. ScopedFs.RemoveAll is the one dereferencing operation that skips the symlink guard every other method enforces. The direct-upload handler runs RemoveAll on the user-controlled path during failed-upload cleanup, gated only by Perm.Create. If an escaping directory symlink already exists inside the user's scope, an authenticated create-only user can delete an out-of-scope target, bypassing both the ScopedFs boundary and the Perm.Delete gate. This vulnerability is fixed in 2.63.16.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-22, CWE-59
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fmm7-x4gx-8jhr | Go | github.com/filebrowser/filebrowser/v2 | <2.63.16 | 2.63.16 |
| GO-2026-6021 | Go | github.com/filebrowser/filebrowser | all versions | no fix published |
| GO-2026-6021 | Go | github.com/filebrowser/filebrowser/v2 | <2.63.16 | 2.63.16 |