Vulnerability Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope (other tenants' data, and the application's own database) via the upload failure-cleanup path. ScopedFs.RemoveAll is the one dereferencing operation that skips the symlink guard every other method enforces. The direct-upload handler runs RemoveAll on the user-controlled path during failed-upload cleanup, gated only by Perm.Create. If an escaping directory symlink already exists inside the user's scope, an authenticated create-only user can delete an out-of-scope target, bypassing both the ScopedFs boundary and the Perm.Delete gate. This vulnerability is fixed in 2.63.16.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8j
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8j
FAQ
What is CVE-2026-55667?
CVE-2026-55667 is a vulnerability with a CVSS score of 8.2 (HIGH). File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding...
How severe is CVE-2026-55667?
CVE-2026-55667 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55667?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.