File Browser does not limit symbolic link resolution for its HTTP handlers before version 2.63.14, enabling a user scoped to a specific directory to follow a link whose lexical path appears inside the scope but whose real target lies outside. This flaw permits the scoped user, and even an unauthenticated recipient of a public share link, to read, overwrite, or share any file reachable via the symlink, effectively breaching confidentiality and integrity of data beyond the intended boundary.

All versions of the File Browser file‑management interface older than 2.63.14 are affected. The vulnerability applies to the default scoped user accounts and any public‑share recipients whose links target files through such symlinks.

The CVSS score of 7.5 indicates a high‑severity flaw. EPSS is not currently available, so the exact likelihood of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires sending or manipulating an HTTP request handled by File Browser’s file endpoints; a scoped user can trigger the flaw via normal file operations, while an unauthenticated user can exploit it through a lingering public share link. The attack path is local to the web application, and no additional system privileges are needed beyond normal user access or the public share URL.