Prior to version 2.63.16, a user with only Create permission in File Browser can delete arbitrary files outside their tenant area. The vulnerability arises from the upload failure-cleanup process that calls ScopedFs.RemoveAll on a path controlled by the uploader, bypassing the symlink guard normally enforced by other methods. If a symlink already exists within the user's scoping directory that points to an exterior file or directory, that file becomes subject to deletion. The attacker gains the ability to remove third‑party tenant data or application internal files, potentially compromising data integrity and availability, and elevating their privileges beyond the intended Create scope.

File Browser (filebrowser:filebrowser) versions earlier than 2.63.16 are affected. All installations using create‑only scoped users and permitting symlink creation within the user’s working directory are at risk.

The CVSS score of 8.2 indicates high severity, and although EPSS is not listed, the lack of mitigation in the affected versions suggests a non‑negligible exploitation probability. The exploit requires only an authenticated user with Create permission and the ability to create a symlink inside their scope, making it trivially achievable in typical multi‑tenant deployments. The vulnerability is not yet listed in the CISA KEV catalog, but the combination of high CVSS and known misuse patterns warrants proactive remediation.