CVE-2026-55668
MediumCVSS 6.3Summary
A vulnerability in File Browser before version 2.63.16 allows an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. The issue arises because ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation.
Risk Assessment
An attacker can place malicious files outside their container, potentially leading to privilege escalation, modification of critical system files, or data integrity compromise.
Recommendation
Immediately update File Browser to version 2.63.16 or later, which contains a fix for this vulnerability.
Other vulnerabilities in File Browser
See all- CVE-2026-82236Low
File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication.
- CVE-2026-72837High
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.
- CVE-2026-73612High
File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory, defeating rule-based isolation for confidentiality and integrity.
- CVE-2026-54089Critical
File Browser is a file management interface that, starting from version 2.0.0-rc.1, allows unauthenticated attackers to impersonate users, including admins, by sending a forged HTTP header. No credentials are required to gain access.
- CVE-2026-54088Critical
File Browser prior to version 2.63.6 had a vulnerability in the Hook Authentication feature that allowed delegating login verification to an external shell command. User-supplied credentials were interpolated into this command string without sanitization, enabling remote attackers to execute arbitrary OS commands before any authentication.
- CVE-2026-62684Low
File Browser prior to 2.63.17 directly serializes the Link storage struct in sharePostHandler, shareListHandler, and shareGetsHandler, exposing password_hash and the bypass token in API responses. An administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares.
- CVE-2026-73611Medium
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint.
- CVE-2026-62843Medium
A vulnerability in File Browser from version 2.63.6 to 2.63.16 allows a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated archive. The issue stems from the use of strings.ReplaceAll(nameInArchive, "\", "/") in the archive builder, which turns a POSIX filename such as ..\..\evil.sh into the archive entry ../../evil.sh.
- CVE-2026-62685High
In File Browser before version 2.63.17, when Signup and CreateUserDir are enabled, the cleanUsername() function normalizes usernames in a way that can cause collisions (e.g., 'team/one', 'team one', and 'team-one' map to the same home directory). This allows a second registrant to gain full access to another user's files.
- CVE-2026-62683Low
In File Browser before version 2.63.17, deleting a directory with a trailing slash (e.g., /a/) does not remove the existing public share for that directory (e.g., /a). The bug is caused by improper path normalization in the Bolt database query, leaving a stale share entry. Recreating the same directory re-exposes its content through the old share.
Original NVD description (English source)
File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16.