CVE-2026-90929
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true aimed at a directory fails inside writeFile and the failure-cleanup path calls Fs.RemoveAll on the request path, recursively deleting the entire tree. This cleanup is not gated by Perm.Delete or the checkDescendants rule, so an authenticated non-administrator with default Create and Modify permissions can delete directories they are not authorized to delete.
Risk Assessment
An authenticated non-administrator user can delete directories and files they should not have access to, causing data loss. The lack of a patched version increases the risk.
Recommendation
Restrict Create and Modify permissions to trusted users and consider disabling direct uploads until a patch is released. Regular data backups are recommended.
Other vulnerabilities in File Browser
See all- CVE-2026-55668Medium
A vulnerability in File Browser before version 2.63.16 allows an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. The issue arises because ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation.
- CVE-2026-54089Critical
File Browser is a file management interface that, starting from version 2.0.0-rc.1, allows unauthenticated attackers to impersonate users, including admins, by sending a forged HTTP header. No credentials are required to gain access.
- CVE-2026-54088Critical
File Browser prior to version 2.63.6 had a vulnerability in the Hook Authentication feature that allowed delegating login verification to an external shell command. User-supplied credentials were interpolated into this command string without sanitization, enabling remote attackers to execute arbitrary OS commands before any authentication.
- CVE-2026-90930Medium
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.
- CVE-2026-90928Medium
File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust server memory through concurrent requests, causing denial of service.
- CVE-2026-82236Low
File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication.
- CVE-2026-62684Low
File Browser prior to 2.63.17 directly serializes the Link storage struct in sharePostHandler, shareListHandler, and shareGetsHandler, exposing password_hash and the bypass token in API responses. An administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares.
- CVE-2026-72837High
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.
- CVE-2026-73612High
File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory, defeating rule-based isolation for confidentiality and integrity.
- CVE-2026-73611Medium
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint.
Original NVD description (English source)
File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true aimed at a directory fails inside writeFile (a directory cannot be opened for writing) and the failure-cleanup path then calls Fs.RemoveAll on the request path, recursively deleting the entire tree. This cleanup is gated by neither the Perm.Delete permission nor the checkDescendants rule walk applied by the delete and patch handlers, so an authenticated non-administrator holding only the default Create and Modify permissions can delete directories they are not authorized to delete, including rule-denied files within them. Deletion remains confined to the user's scope because ScopedFs.RemoveAll still enforces the scope guard. The faulty cleanup was introduced in v2.5.0; no patched version is available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS