Description
File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16.
Published: 2026-07-08
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

File Browser is a web‑based file management, which incorrectly validates a dangling symlink’s nearest existing ancestor as in scope and then follows the symlink during file creation. An authenticated user with Create and Modify permissions can create files at arbitrary locations outside the user of files that the user should not be able to access.

Affected Systems

The flaw affects all File Browser installations of the filebrowser:filebrowser product running versions earlier than 2.63.16. Version 2.63. users should ensure they are running 2.63.16 or newer.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. EPSS score of < 1%, and the vulnerability is not listed in the CISA KEV catalog, implying a lower current significance an authenticated session with Create/Modify rights—any legitimate user with those privileges can exploit the flaw. As File Browser operates through a web interface, a remote attacker who can obtain valid credentials or bypass authentication controls could also trigger this issue.

Generated by OpenCVE AI on July 26, 2026 at 17:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to File Browser version 2.63.16 or newer to receive the ScopedFs fix.
  • Restrict or remove Create and Modify permissions for users unless necessary to limit file creation outside authorized directories.
  • Monitor filesystem changes and audit logs for unexpected file creation events, especially outside user‑defined scopes.
  • Ensure the web interface enforces strong authentication and, where possible, IP‑based access restrictions.

Generated by OpenCVE AI on July 26, 2026 at 17:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-8wc8-hf36-mjh9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
History

Wed, 08 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Filebrowser
Filebrowser filebrowser
Vendors & Products Filebrowser
Filebrowser filebrowser
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Description File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16.
Title File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
Weaknesses CWE-22
CWE-59
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N'}

Subscriptions

Filebrowser Filebrowser
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-08T16:11:52.007Z

Reserved: 2026-06-17T00:05:03.777Z

Link: CVE-2026-55668

cve-icon Vulnrichment

Updated: 2026-07-08T16:11:48.231Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T18:00:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-59

    Improper Link Resolution Before File Access ('Link Following')