Technical impact
File Browser implements a TUS protocol DELETE endpoint that should enforce delete permissions. Users who only have Create rights can send a DELETE request and remove any file or directory within the scope granted to them, bypassing the intended Delete permission check. This broken access control flaw violates the principle of least privilege (CWE-284) and leads to unauthorized modification or removal of data, causing potential loss of integrity and availability. The vulnerability is purely an access‑control weakness; it does not allow arbitrary code execution or remote code execution but enables privileged escalation within the application’s file management subsystem.
Affected Systems
The flaw exists in File Browser v2.60 and earlier, up to the release of v2.61.1. Any multi‑user deployment where administrators limit file deletion for certain users is affected. The product is identified in the Vendor/Product list as filebrowser/filebrowser and is documented in the public GitHub releases and advisory.
Risk and Exploitability
The CVSS score of 9.1 indicates critical severity, and the EPSS score of less than 1% suggests that exploitation attempts are rare but possible. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated with a role that includes Create permission; no special network conditions or additional software are required. Once authenticated, the attacker can issue a TUS DELETE request to arbitrary paths within their permitted scope, bypassing the Delete permission check and deleting files or directories. The attack path is straightforward, and the impact is localized to the affected instance’s file hierarchy. Because the flaw affects privileged users, the risk to overall system integrity remains high.
Github GHSA